Rejecting mapping update to [logstash-2018.05.19] as the final mapping would have more than 1 type

Elastic Stack Elasticsearch
1

Hi, I have a problem that when I mapping the type, and it always told me that I have more than 1 type.
my ES is 6.2.4 version.
this is my mapping API:

PUT _template/logstash
{
  "index_patterns": ["logstash-*"],
  "settings": {
    "number_of_shards": 5
  },
  "mappings": {
    "doc": {
      "_source": {
        "enabled": true
      },
      "properties": {
        "IPV4_SRC_ADDR": { "type": "ip"},
        "IPV4_DST_ADDR": { "type": "ip"},
        "PROTOCOL": { "type": "integer"}
      }
    }
  }
}

logstash.conf:

input{
        tcp{
                host => "163.19.X.XX"
                port => 5510
                codec => json

        }
}
filter{
}
output{
elasticsearch {
                codec => "json"
                hosts => ["163.19.X.XX:9200","163.19.X.XX:9200","163.19.X.XX:9200"]
        }

        #       stdout{codec=> rubydebug}

}

elasticsearch log:

[2018-05-19T22:37:11,511][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [ES4] failed to put mappings on indices [[[logstash-2018.05.19/_r8EAZmHSGqFqZHGMkbi9A]]], type [ntopng-*]
    java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2018.05.19] as the final mapping would have more than 1 type: [ntopng-*, doc]
    	at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:501) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:353) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.index.mapper.MapperService.merge(MapperService.java:285) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:313) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:230) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:643) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:273) ~[elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:198) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:133) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:244) [elasticsearch-6.2.4.jar:6.2.4]
    	at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:207) [elasticsearch-6.2.4.jar:6.2.4]
    	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_131]
    	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_131]
    	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]
    [2018-05-19T22:37:11,511][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [ES4] failed to put mappings on indices [[[logstash-2018.05.19/_r8EAZmHSGqFqZHGMkbi9A]]], type [ntopng-*]
    java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2018.05.19] as the final mapping would have more than 1 type: [ntopng-*, doc]
    	at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:501) ~[elasticsearch-6.2.4.jar:6.2.4]

thank you in advance !
I have spent a lot of time on it.

2

Check if you have other templates.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.