# Mappings types
**URL:** https://discuss.elastic.co/t/mappings-types/304477
**Category:** Elasticsearch
**Created:** [May 11, 2022, 2:56pm UTC](https://discuss.elastic.co/t/mappings-types/304477 "2022-05-11T14:56:38Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@hebph001](https://discuss.elastic.co/u/hebph001)
#### Post date: [May 11, 2022, 2:56pm UTC](https://discuss.elastic.co/t/mappings-types/304477/1 "2022-05-11T14:56:38Z")
Hi Elastic community,
I'm having a hard time figuring out what is wrong with my index template configuration, but Kibana shows me a message of "mapping types for this template uses types, which have been removed". I don't know what I did wrong here. I've looked for this [page](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/removal-of-types.html#_what_are_mapping_types), but still I don't what to do. This is not an old template from an older ES version. I'm currently using 8.1. Here's the definition of the mapping in the template:
```auto
{
"mappings": {
"dynamic": "true",
"_data_stream_timestamp": {
"enabled": true
},
"_size": {
"enabled": false
},
"dynamic_templates": [
{
"match_ip": {
"match": "ip",
"match_mapping_type": "string",
"mapping": {
"type": "ip"
}
}
},
{
"match_message": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "match_only_text"
}
}
},
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
],
"date_detection": false,
"numeric_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"agent": {
"properties": {
"ephemeral_id": {
"type": "keyword",
"ignore_above": 1024
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"data_stream": {
"properties": {
"dataset": {
"type": "constant_keyword",
"value": "sophos.xdr"
},
"namespace": {
"type": "constant_keyword",
"value": "default"
},
"type": {
"type": "constant_keyword",
"value": "logs"
}
}
},
"ecs": {
"properties": {
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"elastic_agent": {
"properties": {
"id": {
"type": "keyword",
"ignore_above": 1024
},
"snapshot": {
"type": "boolean"
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"event": {
"properties": {
"dataset": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"host": {
"properties": {
"architecture": {
"type": "keyword",
"ignore_above": 1024
},
"containerized": {
"type": "boolean"
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"os": {
"properties": {
"codename": {
"type": "keyword",
"ignore_above": 1024
},
"family": {
"type": "keyword",
"ignore_above": 1024
},
"kernel": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"platform": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"offset": {
"type": "long"
}
}
},
"sophos": {
"properties": {
"event": {
"properties": {
"category": {
"type": "keyword",
"ignore_above": 1024
},
"created_at": {
"type": "date"
},
"description": {
"type": "keyword",
"ignore_above": 1024
},
"endpoint_id": {
"type": "keyword",
"ignore_above": 1024
},
"endpoint_type": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"kind": {
"type": "keyword",
"ignore_above": 1024
},
"logged_user": {
"type": "keyword",
"ignore_above": 1024
},
"severity": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"source": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
}
}
}
}
}
}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 11, 2022, 7:27pm UTC](https://discuss.elastic.co/t/mappings-types/304477/2 "2022-05-11T19:27:43Z")
Ok I used your and and made it a whole template
It will help in the future if you provide the entire request and the entire error message
tl;dr `_size` is not a valid template field
Why you got a "types" error is not clear to me
```auto
PUT _index_template/discuss-template
{
"index_patterns": [
"my-index*",
"bar-index*"
],
"template": {
"settings": {
"number_of_shards": 1
},
"mappings": {
"dynamic": "true",
"_data_stream_timestamp": {
"enabled": true
},
"_size": {
"enabled": false
},
"dynamic_templates": [
{
"match_ip": {
"match": "ip",
"match_mapping_type": "string",
"mapping": {
"type": "ip"
}
}
},
{
"match_message": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "match_only_text"
}
}
},
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
],
"date_detection": false,
"numeric_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"agent": {
"properties": {
"ephemeral_id": {
"type": "keyword",
"ignore_above": 1024
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"data_stream": {
"properties": {
"dataset": {
"type": "constant_keyword",
"value": "sophos.xdr"
},
"namespace": {
"type": "constant_keyword",
"value": "default"
},
"type": {
"type": "constant_keyword",
"value": "logs"
}
}
},
"ecs": {
"properties": {
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"elastic_agent": {
"properties": {
"id": {
"type": "keyword",
"ignore_above": 1024
},
"snapshot": {
"type": "boolean"
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"event": {
"properties": {
"dataset": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"host": {
"properties": {
"architecture": {
"type": "keyword",
"ignore_above": 1024
},
"containerized": {
"type": "boolean"
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"os": {
"properties": {
"codename": {
"type": "keyword",
"ignore_above": 1024
},
"family": {
"type": "keyword",
"ignore_above": 1024
},
"kernel": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"platform": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"offset": {
"type": "long"
}
}
},
"sophos": {
"properties": {
"event": {
"properties": {
"category": {
"type": "keyword",
"ignore_above": 1024
},
"created_at": {
"type": "date"
},
"description": {
"type": "keyword",
"ignore_above": 1024
},
"endpoint_id": {
"type": "keyword",
"ignore_above": 1024
},
"endpoint_type": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"kind": {
"type": "keyword",
"ignore_above": 1024
},
"logged_user": {
"type": "keyword",
"ignore_above": 1024
},
"severity": {
"type": "keyword",
"ignore_above": 1024
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"source": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"ip": {
"type": "ip"
}
}
}
}
}
}
}
```
Results in
```auto
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "composable template [discuss-template] template after composition is invalid"
}
],
"type" : "illegal_argument_exception",
"reason" : "composable template [discuss-template] template after composition is invalid",
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "invalid composite mappings for [discuss-template]",
"caused_by" : {
"type" : "mapper_parsing_exception",
"reason" : "Failed to parse mapping: Root mapping definition has unsupported parameters: [_size : {enabled=false}]",
"caused_by" : {
"type" : "mapper_parsing_exception",
"reason" : "Root mapping definition has unsupported parameters: [_size : {enabled=false}]"
}
}
}
},
"status" : 400
}
```
Take out the size parameter which is not valid...
Remove this
```auto
"_size": {
"enabled": false
},
```
and it works fine.
```auto
{
"acknowledged" : true
}
```
---
### Author:  [@hebph001](https://discuss.elastic.co/u/hebph001)
#### Post date: [May 11, 2022, 7:43pm UTC](https://discuss.elastic.co/t/mappings-types/304477/3 "2022-05-11T19:43:36Z")
Well, \_size metafield was part of my configuration because I once installed mapper size plugin. Since it is still installed, it work and I don't get any error. The message is displayed in Kibana UI in the Mappings section when I edit that template.
Just in case, I tried to remove \_size field in the mapping and it doesn't change anything.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 11, 2022, 8:09pm UTC](https://discuss.elastic.co/t/mappings-types/304477/4 "2022-05-11T20:09:09Z")
I am not familiar with the mapper size plugin...
`_size` may be returned by the plugin but it may not mean it is valid to set as a parameter can you share the full json and the command you are using to create the template / mapping.
That mapping type detected error generally indicates you are trying to set the
`_type` parameter to something other than `_doc`
or just remove it
---
### Author:  [@hebph001](https://discuss.elastic.co/u/hebph001)
#### Post date: [May 12, 2022, 12:14pm UTC](https://discuss.elastic.co/t/mappings-types/304477/5 "2022-05-12T12:14:24Z")
Here is the whole command to create the template. Nothing is related to \_type or type.
```auto
PUT _index_template/logs-sophos.xdr
{
"index_patterns": [
"logs-sophos.xdr-*"
],
"priority": 200,
"composed_of": [],
"data_stream": {
"hidden": false,
"allow_custom_routing": false
},
"template": {
"mappings": {
"_data_stream_timestamp": {
"enabled": true
},
"numeric_detection": false,
"dynamic": true,
"dynamic_templates": [
{
"match_ip": {
"mapping": {
"type": "ip"
},
"match_mapping_type": "string",
"match": "ip"
}
},
{
"match_message": {
"mapping": {
"type": "match_only_text"
},
"match_mapping_type": "string",
"match": "message"
}
},
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"agent": {
"properties": {
"hostname": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ephemeral_id": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"offset": {
"type": "long"
}
}
},
"elastic_agent": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"snapshot": {
"type": "boolean"
}
}
},
"source": {
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
},
"ip": {
"type": "ip"
}
}
},
"input": {
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"ecs": {
"properties": {
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"data_stream": {
"properties": {
"namespace": {
"type": "constant_keyword",
"value": "default"
},
"type": {
"type": "constant_keyword",
"value": "logs"
},
"dataset": {
"type": "constant_keyword",
"value": "sophos.xdr"
}
}
},
"sophos": {
"properties": {
"event": {
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"endpoint_type": {
"ignore_above": 1024,
"type": "keyword"
},
"endpoint_id": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"kind": {
"ignore_above": 1024,
"type": "keyword"
},
"created_at": {
"type": "date"
},
"logged_user": {
"ignore_above": 1024,
"type": "keyword"
},
"severity": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"host": {
"properties": {
"hostname": {
"ignore_above": 1024,
"type": "keyword"
},
"os": {
"properties": {
"kernel": {
"ignore_above": 1024,
"type": "keyword"
},
"codename": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"family": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"platform": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"containerized": {
"type": "boolean"
},
"ip": {
"type": "ip"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"mac": {
"ignore_above": 1024,
"type": "keyword"
},
"architecture": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"event": {
"properties": {
"dataset": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 12, 2022, 1:42pm UTC](https://discuss.elastic.co/t/mappings-types/304477/6 "2022-05-12T13:42:50Z")
I just ran that exact command on my 8.1.2 and it worked fine result.
Perhaps I am missing some nuance, or it is simply related to the mapper size plugin which I do not have installed.
```auto
{
"acknowledged" : true
}
```
Exactly what error did you get when you ran that?
This returned the correct results
`GET _index_template/logs-sophos.xdr`
And it shows up in the Template Management Fine as well
---
### Author:  [@hebph001](https://discuss.elastic.co/u/hebph001)
#### Post date: [May 12, 2022, 1:56pm UTC](https://discuss.elastic.co/t/mappings-types/304477/7 "2022-05-12T13:56:21Z")
No error is returned when running the PUT command to update the template nor to show it with a GET. The warning/error comes from Kibana.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 12, 2022, 2:00pm UTC](https://discuss.elastic.co/t/mappings-types/304477/8 "2022-05-12T14:00:30Z")
Update I have now installed the mapper size plugin and I do not see an issue either and it seems to work as designed with the `_size` enabled
```auto
PUT _index_template/logs-sophos.xdr
{
"index_patterns": [
"logs-sophos.xdr-*"
],
"priority": 200,
"composed_of": [],
"data_stream": {
"hidden": false,
"allow_custom_routing": false
},
"template": {
"mappings": {
"_data_stream_timestamp": {
"enabled": true
},
"_size": {
"enabled": true
},
"numeric_detection": false,
"dynamic": true,
"dynamic_templates": [
{
"match_ip": {
"mapping": {
"type": "ip"
},
"match_mapping_type": "string",
"match": "ip"
}
},
{
"match_message": {
"mapping": {
"type": "match_only_text"
},
"match_mapping_type": "string",
"match": "message"
}
},
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
},
"agent": {
"properties": {
"hostname": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ephemeral_id": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"log": {
"properties": {
"file": {
"properties": {
"path": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"offset": {
"type": "long"
}
}
},
"elastic_agent": {
"properties": {
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"snapshot": {
"type": "boolean"
}
}
},
"source": {
"properties": {
"domain": {
"ignore_above": 1024,
"type": "keyword"
},
"ip": {
"type": "ip"
}
}
},
"input": {
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"ecs": {
"properties": {
"version": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"data_stream": {
"properties": {
"namespace": {
"type": "constant_keyword",
"value": "default"
},
"type": {
"type": "constant_keyword",
"value": "logs"
},
"dataset": {
"type": "constant_keyword",
"value": "sophos.xdr"
}
}
},
"sophos": {
"properties": {
"event": {
"properties": {
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"endpoint_type": {
"ignore_above": 1024,
"type": "keyword"
},
"endpoint_id": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"category": {
"ignore_above": 1024,
"type": "keyword"
},
"description": {
"ignore_above": 1024,
"type": "keyword"
},
"kind": {
"ignore_above": 1024,
"type": "keyword"
},
"created_at": {
"type": "date"
},
"logged_user": {
"ignore_above": 1024,
"type": "keyword"
},
"severity": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
},
"host": {
"properties": {
"hostname": {
"ignore_above": 1024,
"type": "keyword"
},
"os": {
"properties": {
"kernel": {
"ignore_above": 1024,
"type": "keyword"
},
"codename": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"family": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
},
"version": {
"ignore_above": 1024,
"type": "keyword"
},
"platform": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"containerized": {
"type": "boolean"
},
"ip": {
"type": "ip"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"mac": {
"ignore_above": 1024,
"type": "keyword"
},
"architecture": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"event": {
"properties": {
"dataset": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
}
}
```
results
```auto
{
"acknowledged" : true
}
```
Put in a doc
```auto
POST logs-sophos.xdr-test/_doc
{
"@timestamp": "2022-05-11T17:30:26.000Z"
}
```
Search it and get results
```auto
GET .ds-logs-sophos.xdr-test-2022.05.12-000001/_search
{
"fields": [
"_size"
]
}
```
results
```auto
{
"took" : 533,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : ".ds-logs-sophos.xdr-test-2022.05.12-000001",
"_id" : "9E6LuIABpvjF7kd-uhzW",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2022-05-11T17:30:26.000Z"
},
"fields" : {
"_size" : [
58
]
}
}
]
}
}
```
Ohh I just saw you are using UI... I will take a look but through API all seems good
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 12, 2022, 2:19pm UTC](https://discuss.elastic.co/t/mappings-types/304477/9 "2022-05-12T14:19:43Z")
I have reproduced ... 🙂
So it looks like you are loading the template via the API and then going to the UI... and stepping through... I get the same error
The offending code appears to be this.
I would need to look what `_data_stream_timestamp` is.. I do not notice it in any of my OOTB templates not sure where you got it from...
```auto
"_data_stream_timestamp": {
"enabled": true
}
```
If I take it out and LOAD via the API it seems to work... if I leave it in I get the same error..
Also I went through the UI to try to create the mapping and tried to load the mappings via JSON and this is what I got
if I take out
```auto
"_data_stream_timestamp": {
"enabled": true
}
```
It loads Fine
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/mappings-types/304477/10 "2022-05-12T14:29:08Z")
Looks like it may be a legacy setting used for migrations from indices to data streams I do not think it is needed now for new data streams I can not find it in the reference docs
Found a reference [here](https://spinscale.de/posts/2021-07-07-elasticsearch-data-streams-explained.html)
---
### Author:  [@hebph001](https://discuss.elastic.co/u/hebph001)
#### Post date: [May 12, 2022, 3:30pm UTC](https://discuss.elastic.co/t/mappings-types/304477/11 "2022-05-12T15:30:56Z")
Wow, you're a genius! Seriously, I don't know how I end up with that setting, but it might come from different manipulations I've done without looking thoroughly.
Thank you for your help!
Philippe
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 9, 2022, 3:31pm UTC](https://discuss.elastic.co/t/mappings-types/304477/12 "2022-06-09T15:31:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.