# Rejected mapping because final mapping would have more than one type **URL:** \ **Category:** Elasticsearch\ **Created:** [February 16, 2018, 8:14am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118 "2018-02-16T08:14:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [February 16, 2018, 8:14am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/1 "2018-02-16T08:14:59Z")
Hi, I just migrated my ES from AWS elasticservice to a EC2 instance and despite not having changed anything to my configs or logstash (running on a separate instance) my mapping is suddenly getting rejected. `[logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-netflow-test-2018.07", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"logstash-netflow-test-2018.07", "_type"=>"doc", "_id"=>"uv2dnWEBlrOJlly6qpiU", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [logstash-netflow-test-2018.07] as the final mapping would have more than 1 type: [netflow, doc]` At no point am I defining the type as doc. Logstash output ```auto output { if [type] == "netflow" { elasticsearch { hosts => ["http://myip:9200"] index => "logstash-netflow-test-%{+xxxx.ww}" } } } ``` And the mapping ```auto PUT _template/netflow { "index_patterns" : ["logstash-netflow-test*"], "settings" : { "number_of_shards" : 1, "number_of_replicas" : 0 }, "mappings": { "netflow": { "properties": { "@ingest_time": { "type": "date" }, "@timestamp": { "type": "date" }, "Location": { "type": "keyword", "ignore_above": 256 }, "application_id": { "type": "keyword", "ignore_above": 256 }, "application_id_trans": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dst_addr": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dst_addr_host": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dst_port": { "type": "long" }, "dst_port_trans": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "gateway": { "type": "keyword", "ignore_above": 256 }, "in_bytes": { "type": "long" }, "out_bytes": { "type": "long" }, "protocol": { "type": "long" }, "src_addr": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "src_port": { "type": "long" }, "type": { "type": "keyword", "ignore_above": 256 } } } } } ``` It gets even stranger when I remove http:// from the output, then the error changes to this `[logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-netflow-test-2018.06", :_type=>"doc", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"logstash-netflow-test-2018.06", "_type"=>"doc", "_id"=>"MP2UnWEBlrOJlly6bSdp", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Mixing up field types: class org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType != class org.elasticsearch.index.mapper.KeywordFieldMapper$KeywordFieldType on field Location"` What am I doing wrong? ES 6.2 ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [February 16, 2018, 8:33am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/2 "2018-02-16T08:33:25Z")
Tested with the default mapping and data gets processed like this type: netflow \_type: doc But if I add a "\_type" field to my mapping it complains about there being two type fields despite it not being the same field name. How come the default dynamic template can process data as a type and \_type field and not my mapping? I'm setting the type field in logstash to help ID my data so what should I do? I could do some awkward rename but I can't imagine that being necessary. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 16, 2018, 9:20am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/3 "2018-02-16T09:20:59Z")
The default type for the Elasticsearch output plugin [is 'doc'](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document_type) for Elasticsearch 6.x clusters, which is clashing with the 'netflow' type you have specified in the mapping. I suspect setting `document_type => "netflow"` in the Elasticsearch output should resolve the issue. ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [February 18, 2018, 11:46pm UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/4 "2018-02-18T23:46:09Z")
Hi Christian, Thanks, I will try that. But since types will be removed all together what is the recommended way forward in the future to "id" different types of data from Logstash to Elastic? Should tags be used instead? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 19, 2018, 6:19am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/5 "2018-02-19T06:19:14Z")
You can add a new keyword field to each document and use this to indicate the type. You can then filter on this field, e.g. through saved searches in Kibana. ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [February 19, 2018, 8:30am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/6 "2018-02-19T08:30:41Z")
Thanks. I figured changing netflow to doc and then just add the type field to my mapping works as well. ``` "mappings": { "doc": { "properties": { ``` The type =\> netflow functionality in the logstash input will not be removed, right? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2018, 8:30am UTC](https://discuss.elastic.co/t/rejected-mapping-because-final-mapping-would-have-more-than-one-type/120118/7 "2018-03-19T08:30:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.