Rejecting mapping update ... as the final mapping would have more than 1 type

[davehatma (David Howell)]

I have a brand new ES Docker container running with no indexes or index templates. I PUT a new mapping template for some metrics indexes I want to load and get a 200OK. However, when I try to update ES from LogStash, I get the following:

"Rejecting mapping update to [pymsa_metrics:2018-03-05] as the final mapping would have more than 1 type: [pymsa_metrics, doc]"

Here is my mapping template:
{
"order": 0,
"index_patterns": [
"pymsa_metrics:*"
],
"settings": {
"index": {
"number_of_shards": "1"
}
},
"mappings": {
"entry": {
"properties": {
"application_name": {
"type": "keyword"
},
"application_type": {
"type": "keyword"
},
"container_id": {
"type": "keyword"
},
"correlation_id": {
"type": "keyword"
},
"elapsed": {
"type": "integer"
},
"hh": {
"type": "integer"
},
"hh:mm": {
"type": "keyword"
},
"log_type": {
"type": "keyword"
},
"method": {
"type": "keyword"
},
"mm": {
"type": "integer"
},
"module": {
"type": "keyword"
}
}
}
},
"aliases": {}
}

I've researched to the point where I need to make this post. (I tried to get the mapping text to format better using the supplied toolbar, but alas, I could not).

Any help will be greatly appreciated.

Thanks,

Dave

[Sjaak01 (Sjaak)]

As of 6.x you can't have multiple types anymore. Try something like this:

{
  "template_name": {
    "order": 0,
    "index_patterns": [
      "index-pattern-*"
    ],
    "settings": {
      "index": {
        "number_of_shards": "1",
        "number_of_replicas": "0"
      }
    },
    "mappings": {
      "doc": {
        "properties": {
          "@ingest_time": {
            "type": "date"
          }

Now if you need a type field to match with the type field you might have in your log files you can simply add:

          "type": {
            "type": "keyword",
            "ignore_above": 256

[davehatma (David Howell)]

Sjaak,

Thanks for responding. Please forgive, but I'm not following.... I understand that multiple types for an index is being deprecated and not allowed for new indexes in V6+. However, I am at a loss at to seeing where I am referencing two index types in my mappings config. The error message says I'm trying to do a "pymsa_metrics" AND "doc" types for the index, but I just don't see how that can be. I have followed the example here -- https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html -- as a template, substituting my own values for the index and the fields. The only place I can see in my config that references "type" is in the properties object of the mappings entries.

Would you be able to point out where in MY config I am making the error?

Thanks,

Dave