I am having some issues with my elastic template. When I added the IP fields I receive errors. If I remove them it works fine. Can someone shed light on what I am doing wrong.
I took the default template for logstash and edited it to create the one below. I am in no way a template guru.
Elasticsearch 5.4
Logstash 5.4
Error:
[2017-08-31T07:27:56,794][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"network-data-2017.08.31", :_type=>"eventlog", :_routing=>nil}, 2017-08-31T11:27:52.564Z 10.206.140.219 %{message}], :response=>{"index"=>{"_index"=>"network-data-2017.08.31", "_type"=>"eventlog", "_id"=>"AV44DDFnG5N1_N_4xbGQ", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [false] of different type, current_type [date], merged_type [text]"}}}}
Template:
{ "order": 0, "version": 1, "template": "network-data-*", "settings": { "index": { "refresh_interval": "5s", "number_of_shards": "2", "number_of_replicas":"1" } }, "mappings": { "_default_": { "dynamic_templates": [ { "message_field": { "path_match": "message", "mapping": { "norms": false, "type": "text" }, "match_mapping_type": "string" } }, { "string_fields": { "mapping": { "norms": false, "type": "text", "fields": { "keyword": { "type": "keyword" } } }, "match_mapping_type": "string", "match": "*" } } ], "_all": { "norms": false, "enabled": true }, "properties": { "@timestamp": { "copy_to": false, "type": "date" }, "Src_geoip": { "dynamic": true, "properties": { "ip": { "type": "ip" }, "latitude": { "type": "half_float" }, "location": { "type": "geo_point" }, "longitude": { "type": "half_float" } } }, "Dst_geoip": { "dynamic": true, "properties": { "ip": { "type": "ip" }, "latitude": { "type": "half_float" }, "location": { "type": "geo_point" }, "longitude": { "type": "half_float" } } }, "SourceIp": { "type": "ip" }, "DestinationIp": { "type": "ip" }, "IpAddress": { "type": "ip" }, "Ipaddress": { "type": "ip" }, "@version": { "copy_to": false, "type": "keyword" } } } }, "aliases": {} }