# Mapping works in default index, but not in custom one

**URL:** https://discuss.elastic.co/t/mapping-works-in-default-index-but-not-in-custom-one/354347
**Category:** Elasticsearch
**Tags:** ilm-index-lifecycle-management
**Created:** [February 28, 2024, 1:21pm UTC](https://discuss.elastic.co/t/mapping-works-in-default-index-but-not-in-custom-one/354347 "2024-02-28T13:21:48Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Multiply0057](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@Multiply0057](https://discuss.elastic.co/u/Multiply0057)
#### Post date: [February 28, 2024, 1:21pm UTC](https://discuss.elastic.co/t/mapping-works-in-default-index-but-not-in-custom-one/354347/1 "2024-02-28T13:21:48Z")

</div>

Hello, fellow Elastic enthusiasts!

Despite following the documentation and various online resources, I find myself at a standstill. Here's a brief overview of my setup:

My Logstash pipeline is configured to output data into Elasticsearch. The configuration snippet looks like this:

```auto
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "my_index-custom-stage"
    action => "create"
    user => "logstash_internal"
    password => "${LOGSTASH_INTERNAL_PASSWORD}"
  }
}

```

I've designed a custom ingestion pipeline and mappings for `my_index` to accommodate a complex data structure with nested fields. The mappings are as follows:

```auto
{
  "mappings": {
    "properties": {
      "ip-info": {
        "type": "nested",
        ... // (Additional nested field mappings for clarity)
      }
    }
  }
}

```

When I inspect the data in the `my_index` data stream view, I only observe the original `ip-info` object in its JSON format. Conversely, when examining the default `logs-*` index view, the `ip-info` object is parsed correctly, displaying all nested fields as expected.  
This is a document in my\_index and the same document in default logs-\* index:  
 ![mapping](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a593cd961e0c3d8e385ee6c568c0349319a8551.png)

Despite numerous attempts to resolve the issue—including switching from data streams to indexes, ensuring mappings are in place before ingesting any documents, and tweaking various settings—I've hit a wall. The `my_index` retains the nested field as JSON, whereas the `logs-*` index parses it without any problem.

Has anyone faced a similar challenge, or does anyone have insights into what might be going wrong? Here are my specific questions:

1. Why does the `my_index` not parse the nested `ip-info` object correctly, while the default `logs-*` index does?
2. Are there any recommended debugging steps or configurations I might have overlooked that could resolve this parsing discrepancy?

Thank you in advance!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2024, 1:22pm UTC](https://discuss.elastic.co/t/mapping-works-in-default-index-but-not-in-custom-one/354347/2 "2024-03-27T13:22:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
