Hi all,
This is my mapping.
curl http://localhost:9200/indexname/_mapping/log?pretty
{
"fortigate" : {
"mappings" : {
"log" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {
"type" : "string"
},
"duration" : {
"type" : "string"
},
"geoip" : {
"properties" : {
"area_code" : {
"type" : "long"
},
**"location" : {**
**"type" : "double"**
**},**
"longitude" : {
"type" : "double"
},
"postal_code" : {
"type" : "string"
},
"real_region_name" : {
"type" : "string"
},
"region_name" : {
"type" : "string"
},
"timezone" : {
"type" : "string"
}
}
},
"group" : {
"type" : "string"
},
"host" : {
"type" : "string"
},
"hostname" : {
"type" : "string"
},
"identix" : {
"type" : "string"
},
"level" : {
"type" : "string"
},
"logid" : {
"type" : "string"
},
"mastersrcmac" : {
"type" : "string"
},
"message" : {
"type" : "string"
},
"month" : {
"type" : "string"
},
"osname" : {
"type" : "string"
},
"vd" : {
"type" : "string"
},
"year" : {
"type" : "string"
}
}
}
}
}
}
I want to change the 'location' field type into geo_point under geoip.I tried to change by using following curl command.
curl -XPUT 'http://localhost:9200/fortigate/log/_mapping' -d '
{
"geoip" : {
"properties" : {
"location" : {"type" : "geo_point"}
}
}
}'
But it shows the following error.
{"error":"MapperParsingException[Root type mapping not empty after parsing! Remaining fields: [geoip : {properties={location={type=geo_point}}}]]","status":400}
Kindly help me to solve this issue.
Thanks
Mahesh