New fields not in elasticsearch template

Elastic Stack Elasticsearch
1

What happens when my logstash has a new field e,g. field33 which I did not have a matching entry in the elasticsearch template?

Will records with the field33 be automatically discarded

2

Mapping will be updated and document indexed.

3

I am having this problem now.

field33 is a ip address

If I do this

"field33": {
"type": "ip"

    }

I will get this error

s"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to pars
e", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Mixing up field
types: class org.elasticsearch.index.mapper.core.LongFieldMapper$LongFieldType !
= class org.elasticsearch.index.mapper.ip.IpFieldMapper$IpFieldType on field field33"}}}}, :level=>:warn}←[0m

So I am forced to not do any mapping at the template level

4

Please format your code using </> icon as explained in this guide. It will make your post more readable.

Or use markdown style like:

```
CODE
```

I guess you may be have already a mapping?
You need to reindex (drop the index and create again).

5

I have managed to solve the problem. It is probably caused by multiple template being applied to the same index and these templates had different type for the same field.

I am very sure that I did not apply multiple templates to the same index but it happened. What I did was to delete all custom template and re-add them one by one.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.