# Mapping conflicts

**URL:** <https://discuss.elastic.co/t/mapping-conflicts/89990>\
**Category:** Logstash\
**Created:** [June 19, 2017, 8:37pm UTC](https://discuss.elastic.co/t/mapping-conflicts/89990 "2017-06-19T20:37:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\
**Post date:** [June 19, 2017, 8:37pm UTC](https://discuss.elastic.co/t/mapping-conflicts/89990/1 "2017-06-19T20:37:53Z")

</div>

Hey guys,

ive installed a new ELK Stack.

I want to filter some Cisco ASA Firewall Logs and tried to find the best filters.

Because of some strange behavior would i go to the main configuration without filters (only Input via syslog and output to Elasticsearch)

Now i get all the times such Messages:

```
 [2017-06-19T22:26:52,600][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch.{status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2017.06.19", :_type=>"logs", :_routing=>nil}, 2017-06-19T20:26:52.548Z %{host} 2017-06-19T20:26:52.735Z 1.2.3.4 <167>Jun 19 2017 22:26:55: %ASA-7-710006: VRRP request discarded from 4.5.6.7 to OUTSIDE:224.0.0.45
], :response=>{"index"=>{"_index"=>"logstash-2017.06.19", "_type"=>"logs", "_id"=>"AVzCET7ojGYkI8OXhKm0", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Mapper for [@timestamp] conflicts with existing mapping in other types:\n[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]"}}}}

```

Ive already delete all indices but it is still not working.

Have anyone a idea?

Best Regards

Daniel

---

<div class="post-metadata">

**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\
**Post date:** [June 20, 2017, 6:55pm UTC](https://discuss.elastic.co/t/mapping-conflicts/89990/2 "2017-06-20T18:55:21Z")

</div>

Hey guys,

i have solved this issue by myself.

i forgot in my if clause in the type field this [].  
`if [type] == "cisco-asa" {`

Best Regards

Daniel

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2017, 6:55pm UTC](https://discuss.elastic.co/t/mapping-conflicts/89990/3 "2017-07-18T18:55:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.