Rejecting mapping update to [] as the final mapping would have more than 1 type

Elastic Stack Elasticsearch
1

Hi! I've just upgraded to ES6 and my ES logs started to throw this error:

[2018-03-16T15:31:05,759][DEBUG][o.e.a.b.TransportShardBulkAction] [logstash-2018.03.16][3] failed to execute bulk item (index) BulkShardRequest [[logstash-2018.03.16][3]] containing [index {[logstash-2018.03.16] (Lots of data here about the log)
java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2018.03.16] as the final mapping would have more than 1 type: [doc, gelf_json]
	at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:501) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:353) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.index.mapper.MapperService.merge(MapperService.java:285) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:313) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:230) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:643) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:273) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:198) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:133) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:244) ~[elasticsearch-6.2.2.jar:6.2.2]
	at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:207) ~[elasticsearch-6.2.2.jar:6.2.2]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_161]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_161]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]

I have Logstash 6.2.2 and Beats (winlog and filebeats) shipping to this ES.
In Logstash I have a conf.d/10-gelf.conf as follows:

input {
  gelf {
    type => "gelf_json"
    port => "XXXX"
  }
}

Any help or idea?
Thanks a lot!

2

This has been answered a few times. See this reply for more information

1 Like
3

Hey, thanks for the reply!
Yes, I've seen that post and that blog post, but I am in the final lines of the blog, where it says:

I have more questions! Tell me more!
Step 1: don't panic :slight_smile:
Step 2: please let us know on our forums

Is the type => "gelf_json the part that is giving me problems?
Because as far as I know (I am no expert in ES) that sets the field "type", not the "_type" one, right?

Thanks!

4

Yes that is the part. This log line shows that

java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2018.03.16] as the final mapping would have more than 1 type: [doc, gelf_json]

The logstash index already has a type doc, this is trying to assign it another type.

5

Then we cannot have more than one _type nor type?
Is everything tagged as type:doc by default? Then what's the point of having this option?

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html#plugins-inputs-udp-type

Thanks!

2 Likes
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.