# Mapper \[signal.ancestors.index\] cannot be changed from type \[text\] to \[keyword\] **URL:** \ **Category:** Elastic Security\ **Created:** [January 17, 2023, 2:12pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331 "2023-01-17T14:12:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Enrico\_Pasqualotto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrico_pasqualotto/32/109151_2.png) [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Post date:** [January 17, 2023, 2:12pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/1 "2023-01-17T14:12:34Z")
Hello, probably after an upgrade (current ver. 7.17.6) every time we accesso to alerts/rules of Security section we got the following error: { "name": "Error", "body": { "message": "illegal\_argument\_exception: mapper [signal.ancestors.index] cannot be changed from type [text] to [keyword]", "status\_code": 400 }, "message": "Bad Request", How can we fix this? We don't care about data (can be erased) we need only to fix this and restart using the alerts and rules. Thanks ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 19, 2023, 11:52pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/2 "2023-01-19T23:52:12Z")
Hey there, You can simply delete the .siem-signals- index to resolve this, since you don’t care about the data. Did you upgrade from any previous versions before you ran into this? James ---
**Author:** ![Enrico\_Pasqualotto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrico_pasqualotto/32/109151_2.png) [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Post date:** [January 20, 2023, 2:45pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/3 "2023-01-20T14:45:42Z")
Thanks James, I've already tried to delete the index but the issue reappear. Yes, this can be caused by an update of ELK. Any hint? ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 20, 2023, 4:52pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/4 "2023-01-20T16:52:39Z")
You may want to try running a manual migration - [Detection Alerts Migration API | Elastic Security Solution [8.6] | Elastic](https://www.elastic.co/guide/en/security/current/signals-migration-api.html) ---
**Author:** ![Enrico\_Pasqualotto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrico_pasqualotto/32/109151_2.png) [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Post date:** [January 20, 2023, 5:29pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/5 "2023-01-20T17:29:56Z")
This is the migration status: {"indices":[{"index":".siem-signals-default-000001","version":0,"signal\_versions":[{"version":57,"count":179671}],"migrations":,"is\_outdated":true}]} but if I force the migration the index result as write index and I got: {"indices":[{"index":".siem-signals-default-000001","error":{"message":"The specified index is a write index and cannot be migrated.","status\_code":400},"migration\_id":null,"migration\_index":null}]} ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 23, 2023, 2:38pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/6 "2023-01-23T14:38:36Z")
Hi Enrico, which step of the migration process gave you that message? ---
**Author:** ![Enrico\_Pasqualotto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrico_pasqualotto/32/109151_2.png) [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Post date:** [January 23, 2023, 3:18pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/7 "2023-01-23T15:18:17Z")
this one: `/api/detection_engine/signals/migration` ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [January 23, 2023, 11:19pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/8 "2023-01-23T23:19:22Z")
Can you share the post payload you provided? ---
**Author:** ![Enrico\_Pasqualotto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enrico_pasqualotto/32/109151_2.png) [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Post date:** [January 24, 2023, 2:13pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/9 "2023-01-24T14:13:03Z")
curl -k -X POST "[https://192.168.1.183/api/detection\_engine/signals/migration](https://192.168.1.183/api/detection_engine/signals/migration)" -u elastic:password -H 'kbn-xsrf: true' -H "Content-Type: application/json" -d '{ "index": [".siem-signals-default-000001"] }' ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2023, 2:13pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331/10 "2023-02-21T14:13:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.