Mapping, error my normalizer

Elastic Stack Elasticsearch
1

Help, how to create a mapping in elasticsearch ?

image

PUT /sdm_cr_nrt/_mapping
{
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text"
        },
        "affected_resource" : {
          "type" : "keyword"
        },
        "affected_resource_descr" : {
          "type" : "keyword"
        },
        "affected_service" : {
          "type" : "keyword"
        },
        "assignee_email" : {
          "type" : "keyword"
        },
        "assignee_name" : {
          "type" : "keyword",
          "ignore_above" : 256,
          "normalizer" : "my_normalizer"
        }
      },
      "settings": {
        "analysis": {
          "normalizer": {
            "my_normalizer": {
              "type": "custom",
              "char_filter": [],
              "filter": ["lowercase", "asciifolding"]
            }
          }
        }
      }
}
2

fixed, "/ _mapping" error in put

3

But then you are missing the mappings key in the json at the same level you have settings key.

4

thanks!

PUT /sdm_cr_nrt
{
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text"
        },
        "affected_resource" : {
          "type" : "keyword"
        },
        "affected_resource_descr" : {
          "type" : "keyword"
        },
        "affected_service" : {
          "type" : "keyword"
        },
        "assignee_email" : {
          "type" : "keyword"
        },
        "assignee_name" : {
          "type" : "keyword",
          "ignore_above" : 256,
          "normalizer" : "my_normalizer"
        },
        "call_back_date" : {
          "type" : "date"
        },
        "category" : {
          "type" : "text"
        },
        "close_date" : {
          "type" : "date"
        },
        "comments" : {
          "properties" : {
            "comment_action_desc" : {
              "type" : "text"
            },
            "comment_description" : {
              "type" : "text"
            },
            "comment_id" : {
              "type" : "long"
            },
            "comment_last_mod_dt" : {
              "type" : "date",
              "format" : "epoch_millis"
            },
            "comment_system_time" : {
              "type" : "long"
            },
            "comment_type" : {
              "type" : "keyword"
            }
          }
        },
        "customer_admin_org_name" : {
          "type" : "keyword"
        },
        "customer_location_country_name" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "customer_location_name" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "customer_name" : {
          "type" : "text"
        },
        "customer_organization_name" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "customer_type" : {
          "type" : "keyword"
        },
        "description" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "g_application" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "g_businessunit" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "g_country" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "g_critical" : {
          "type" : "boolean"
        },
        "g_flag" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "g_kpi" : {
          "type" : "boolean"
        },
        "g_last_mod_date" : {
          "type" : "date",
          "format" : "epoch_millis"
        },
        "g_last_mod_dt" : {
          "type" : "date"
        },
        "g_local" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "g_sox" : {
          "type" : "boolean"
        },
        "group_organization_name" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "http_request_failure" : {
          "properties" : {
            "error" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "name" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "request" : {
              "properties" : {
                "method" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "url" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            },
            "runtime_seconds" : {
              "type" : "float"
            }
          }
        },
        "id_ref" : {
          "type" : "keyword"
        },
        "impact" : {
          "type" : "keyword"
        },
        "management" : {
          "type" : "keyword"
        },
        "message" : {
          "type" : "text"
        },
        "open_date" : {
          "type" : "date"
        },
        "persistent_id" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "priority" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "problem" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "report_mode" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "requestor" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "resolve_date" : {
          "type" : "date"
        },
        "rootcause" : {
          "type" : "keyword"
        },
        "sap_frontend" : {
          "type" : "keyword"
        },
        "sap_instance" : {
          "type" : "keyword"
        },
        "sap_msg" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "status" : {
          "type" : "keyword"
        },
        "status_sym" : {
          "type" : "keyword"
        },
        "summary" : {
          "type" : "keyword",
          "normalizer" : "my_normalizer"
        },
        "support_lev_sym" : {
          "type" : "keyword"
        },
        "tags" : {
          "type" : "keyword",
          "ignore_above" : 256
        },
        "type" : {
          "type" : "keyword"
        },
        "urgency" : {
          "type" : "keyword"
        },
        "zcausa_raiz" : {
          "type" : "keyword"
        },
        "zsolucion_fondo" : {
          "type" : "keyword"
        },
        "zsolucion_mitig" : {
          "type" : "keyword"
        },
        "ztxt_causa_raiz" : {
          "type" : "keyword"
        },
        "ztxt_solucion_fondo" : {
          "type" : "keyword"
        },
        "ztxt_solucion_mitig" : {
          "type" : "keyword"
        }
      }
    },
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "max_result_window" : "35000",
        "analysis" : {
          "normalizer" : {
            "my_normalizer" : {
              "filter" : [
                "lowercase",
                "asciifolding"
              ],
              "type" : "custom",
              "char_filter" : [ ]
            }
          }
        },
        "number_of_replicas" : "1"
      }
    }
}
5

now i have another error

There are fields that can be null

[2021-03-11T20:09:42,459]
[WARN ]
[logstash.outputs.elasticsearch]
[json_petition.conf]
[517d3c152dead3a4b07f71516ab9e221f38515a3984714250b2efd37c173137c] 
Could not index event to Elasticsearch. 
{:status=>400,
 :action=>[
"index", {:_id=>"11480537", :_index=>"sdm_cr_nrt", :routing=>nil, 
:_type=>"_doc"}, #<LogStash::Event:0x74173ee9>], 
:response=>{"index"=>{"_index"=>"sdm_cr_nrt", 
"_type"=>"_doc", "_id"=>"11480537", 
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception",
 "reason"=>"failed to parse field [close_date] of type [date] in document with id '11480537'. 
Preview of field's value: ''", 
"caused_by"=>{"type"=>"illegal_argument_exception", 
"reason"=>"cannot parse empty date"}}}}}
6

You can not send an empty string as a date.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.