Rollup job failed to create due to inal mapping would have more than 1 type: [_doc, doc]"

[Yoav_Sharon]

Hi,
i'm trying to create a rollup job. the return result is fail due to "final mapping would have more than 1 type: [_doc, doc]""
my mapping template is attached:
put _template/defualt
{
"order": 0,
"index_patterns": [
"vlte*","vr*","vnm*","Node*"
],
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "1600"
}
},
"refresh_interval": "5s",
"number_of_shards": "3",
"number_of_replicas": "1"
}
},
"mappings": {
"doc": {
"properties": {
"DateAndTimeEnd": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
},
"DateAndTimeStart": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
}
}
}
}
}
i've read the new type handling but can't figure out what is missing

[polyfractal (Zachary Tong)]

Hey @Yoav_Sharon, sorry for the delay in answering this!

I believe what's happening is that your index template is also matching the destination rollup index. Internally Rollup uses "_doc" for the type name (it's hardcoded), and your template uses "doc". So when Rollup creates the destination index to store the results, it tries to create it with _doc but then the index template is applied with doc and it throws that exception about being more than one type.

Eventually this sort of thing will go away when types are removed entirely.

For now, the easiest thing to do is make sure the rollup destination indices don't match your index template, or make sure your index templates use _doc.

BTW, _doc is the recommended doc type in the future because the various API URLs will use _doc where the type used to be specified. So it'll make upgrading easier.

[berg]

@Yoav_Sharon I ran into this; the annoying thing about _doc is that the default _type for logstash elasticsearch output is... doc.
https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document_type

• for elasticsearch clusters 6.x and above: the value of doc will be used;

You can imagine the annoying process of trying to write logstash config to manage the process of migrating from doc the logstash default to _doc the elasticsearch default, when you have indices being created on weekly, monthly and yearly patterns. I have to wait until a month starting on Monday swings around to do this in a one step process. As you point out, it's not the end of the world to create the rollup target indices outside of your existing index templates scope, just an annoying problem to work around.

I built my ES template off the logstash default and missed this being different from the ES default. I guess that learns me for not thinking about this better during the ES6 upgrade cycle