Rollup Fail: Existing mapping for field must be of type object

Elastic Stack Elasticsearch
1

Our rollup job will not run and we are getting the following error log:

[991]: index [issues-prod1], type [_doc], id [issues-prod1$ONEl7qIplbk6ayAuSYbUkA], message [MapperParsingException[Could not dynamically add mapping for field [category.terms._count]. Existing mapping for [category] must be of type object but found [keyword].]]
ex [issues-prod1], type [_doc], id [issues-prod1$g4xayKx3fDB9tjy5sjL_4A], message [MapperParsingException[Could not dynamically add mapping for field [category.terms._count]. Existing mapping for [category] must be of type object but found [keyword].]]
[985]: index [issues-prod1], type [_doc], id [issues-prod1$PxsTMNX_88zzL5JND6YMEg], message [MapperParsingException[Could not dynamically add mapping for field [category.terms._count]. Existing mapping for [category] must be of type object but found [keyword].]]

The rollup has 4 terms (keyword fields):

  • type
  • source
  • category
  • subcategory

The index mapping:

{
    "issues-prod1": {
        "mappings": {
            "properties": {
                "category": {
                    "type": "keyword",
                    "ignore_above": 50
                },
                "errors": {
                    "type": "long"
                },
                "source": {
                    "type": "keyword",
                    "ignore_above": 20
                },
                "subcategory": {
                    "type": "keyword"
                },
                "timestamp": {
                    "type": "date",
                    "format": "date_time||epoch_millis"
                }
            }
        }
    }
}

The rollup definition:

{
    "index_pattern": "logs-errors-prod*",
    "rollup_index": "issues-prod1",
    "cron": "0 55 * * * ?",
    "groups": {
        "date_histogram": {
            "interval": "1d",
            "field": "timestamp",
            "delay": "1m",
            "time_zone": "Europe/Zurich"
        },
        "terms": {
            "fields": [
                "type",
                "source",
                "category",
                "subcategory"
            ]
        }
    },
    "metrics": [],
    "timeout": "20s",
    "page_size": 1000
}

We do not have any documents in our index logs-errors-prod which have category.keyword

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.