Hi everybody,
I'm a newbie on ELK and for some unknown reasons, as it was working without any changes on my side in any configuration, I'm facing to following issue :
mapper [hits.data.billing_address.postal_code] of different type, current_type 2018-11-28 17:09:11
My logstash config :
input {
exec {
command => "python dashboard-new.py"
interval => 1799
id => "getToken-getOrders-new"
codec => "json"
}
}
filter {
mutate {
rename => { "[_type]" => "type" }
}
json {
source => "data"
}
}
output {
stdout {
id => "stdout"
codec => rubydebug { metadata => true }
}
elasticsearch {
id => "elasticsearch"
hosts=>"http://localhost:9200"
}
}
The actual mapping
GET logstash-2018.11.28/_mapping
Output :
{
"logstash-2018.11.28" : {
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"norms" : false,
"type" : "text"
}
}
},
{
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"fields" : {
"keyword" : {
"ignore_above" : 256,
"type" : "keyword"
}
},
"norms" : false,
"type" : "text"
}
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "keyword"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
}
}
}
}
}
}
I read diferent articles that saying that's not possible to change mapping and I need to create a template that will be indexed.
Now, I'd like to understand why I'm facing to that issue, and now, I'd like to understand how to solve it in a quick way, as I spent lot of hours with no correct solution.
May I ask somebody to guide me on how to solve that issue ?
++
Saad.