Storing Ansible facts in Elasticsearch (JSON) & mapper parsing exception

Elastic Stack Elasticsearch
2

Hi,

I guess you should read a little bit about how mappings work in Elasticsearch. See e.g. reference docs and the Definitive Guide. This will help you a lot. :slight_smile:

On to your problem. Based on what you write I infer that you use Elasticsearch 5. There is also a factbeat that gathers data with facter and puts them into Elasticsearch. It also defines a mapping and you can use that for your index. Note that the author states in the README that facter 3 should be used as it produces more structured output.

First we remove the index again:

DELETE /facts

Then please also remove all index tempates:

DELETE /_template/*

Finally you can add your index template (as I said, this is based on the factbeat index template):

PUT /_template/facts
{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "facts-*"
}

Then you can add an example document:

POST /facts/my-fact/1
{
    "ansible_local": {
        "updates_facter": {
            "Packages": {
                "Installed": {
                    "acl": "2.2.52-3"
                }
            }
        }
    }
}

and delete it again:

DELETE /facts/my-fact/1

Daniel