Hi Team,
I am currently observing the below error. Strangely, it worked for the first time, later on I had to an additional field (Tag) to my data and that was the only change I have done and now i get the mapping error. I was not able to figure out the reason behind it and now when i remove the field i added, I still get this error. ELK version - 6.2.3
Error:
[2018-03-23T06:15:30,271][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x6ac12f62>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"sffsf_HFKJ_sajfkjf6", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [healthccms-2018.03.23] as the final mapping would have more than 1 type: [my_doc, doc]"}}}}
Update 2:
When i changed my mappings name to doc
, i get the below error. I see there is nothing relevant to the error i got and the template i have.
[2018-03-23T06:46:57,483][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x3a60947e>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"gjYcU2IB9pgc1BKZxkks", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Could not convert [message.index] to boolean", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Failed to parse value [not_analyzed] as only [true] or [false] are allowed."}}}}}}
My Mapping Template:
{
"template" : "healthccms-*",
"settings" : {
"index.refresh_interval" : "10s"
},
"mappings" : {
"my_doc": {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"type" : "keyword", "index" : "not_analyzed", "omit_norms" : true
},
"match_mapping_type" : "string"
}
},
{
"integers": {
"match_mapping_type": "long",
"mapping": {
"type": "integer"
}
}
},
{
"string_fields" : {
"mapping" : {
"type" : "text", "index" : "analyzed", "norms": false,
"fields" : {
"keyword" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 1024}
}
},
"match_mapping_type" : "string",
"match" : "*"
}
}
],
"properties" : {
"@timestamp" : { "format" : "dateOptionalTime","type" : "date" },
"@version":{ "type": "keyword" },
"host": { "type": "keyword" },
"path": { "type": "keyword" },
"ETime": { "type": "date", "format" : "dateOptionalTime" },
"OverAllStatus": { "type": "integer" },
"Env": { "type": "keyword" },
"HostAddress": { "type": "keyword" },
"ThresholdDiskSpace": { "type": "keyword" },
"Tag": { "type": "integer" }
}
}
}
}
I see in the documentation that the mapping contains more than 1 type, i actually didn't understand what does that mean. Can someone help me understand what is the issue in the template and how can i overcome it.