We are having ELK 6.1.1, we don't have any indices but we still have error for mapping conflit when new event come. Any idea why?
[2018-12-20T11:48:41,891][WARN ][logstash.outputs.elasticsearch] Could not index event to
Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.12.20",
:_type=>"sbc_event", :_routing=>nil}, 2018-12-20T10:48:41.000Z %{host} %{message}], :response=>
{"index"=>{"_index"=>"logstash-2018.12.20", "_type"=>"sbc_event", "_id"=>"AWfLO1KCYlwgs24PRNeG",
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"[geoip.location] is defined
as an object in mapping [sbc_event] but this name is already used for a field in other types"}}}}
Logstash settings:
elasticsearch {
template => "/etc/logstash/templates/elasticsearch-logstash-template.json"
template_name => "logstash"
document_type => "sbc_event"
index => "logstash-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
}
Mapping (just geoip part):
"geoip": {
"dynamic": false,
"type": "object",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "float"
},
"country_name": {
"index": true,
"type": "keyword"
},
"country_code2": {
"index": true,
"type": "keyword"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "float"
}
}
}