I'm using filebeat -> pipeline -> Elasticsearch, so at the moment everything is going to one index.
at some point this field structure was inferred from my data
"name": {
"properties": {
"first_name": {
"type": "keyword",
"ignore_above": 1024
},
"last_name": {
"type": "keyword",
"ignore_above": 1024
},
"middle_name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
however, I'm also getting name
records that are just strings and not objects:
{"type":"mapper_parsing_exception","reason":"object mapping for [app.name] tried to parse field [name] as object, but found a concrete value"}, dropping event!
How can I resolve?
I tried calling
GET filebeat-7.17.3/_mapping
and as a test writing back the output
PUT filebeat-7.17.3/_mapping
{
"mappings": {
"_meta": {
"beat": "filebeat",
"version": "7.17.3"
},
"dynamic_templates": [
{
"labels": {
"path_match": "labels.*",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
...
but immediately get an error
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [mappings : {_meta={beat=filebeat, version=7.17.3},
(1) Is there an easy way to fix a single typing error like app.name
(2) Is there a way to get the file mapping from GET
, modify it and resupply it to PUT
?
Thanks!