The final mapping would have more than 1 type Error - Intermittent

Elastic Stack Elasticsearch
1

Hi Team,

I am currently observing the below error. Strangely, it worked for the first time, later on I had to an additional field (Tag) to my data and that was the only change I have done and now i get the mapping error. I was not able to figure out the reason behind it and now when i remove the field i added, I still get this error. ELK version - 6.2.3

Error:

[2018-03-23T06:15:30,271][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x6ac12f62>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"sffsf_HFKJ_sajfkjf6", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [healthccms-2018.03.23] as the final mapping would have more than 1 type: [my_doc, doc]"}}}}

Update 2:
When i changed my mappings name to doc, i get the below error. I see there is nothing relevant to the error i got and the template i have.

[2018-03-23T06:46:57,483][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x3a60947e>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"gjYcU2IB9pgc1BKZxkks", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Could not convert [message.index] to boolean", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Failed to parse value [not_analyzed] as only [true] or [false] are allowed."}}}}}}

My Mapping Template:

{
  "template" : "healthccms-*",
  "settings" : {
    "index.refresh_interval" : "10s"
  },
 "mappings" : {
     "my_doc": {
	   "dynamic_templates" : [
          {
            "message_field" : {
              "path_match" : "message",
              "mapping" : {
               "type" : "keyword", "index" : "not_analyzed", "omit_norms" : true
           },
              "match_mapping_type" : "string"
            }
          },
          
		  {
		    "integers": {
            "match_mapping_type": "long",
            "mapping": {
              "type": "integer"
            }
          }
        },
		  
		  {
            "string_fields" : {
              "mapping" : {
                "type" : "text", "index" : "analyzed", "norms": false,
                "fields" : {
                  "keyword" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 1024}
                }
              },
              "match_mapping_type" : "string",
              "match" : "*"
            }
          }
        ],
      
       
  "properties" : {
"@timestamp" : { "format" : "dateOptionalTime","type" : "date" },
"@version":{ "type": "keyword" },
"host": { "type": "keyword" },
"path": { "type": "keyword" },
"ETime": { "type": "date", "format" : "dateOptionalTime" },
"OverAllStatus": { "type": "integer" },
"Env": { "type": "keyword" },
"HostAddress": { "type": "keyword" },
"ThresholdDiskSpace": { "type": "keyword" },
"Tag": { "type": "integer" }
    
       }
    }
  }
}

I see in the documentation that the mapping contains more than 1 type, i actually didn't understand what does that mean. Can someone help me understand what is the issue in the template and how can i overcome it.

2

It looks like you might be using the mapping syntax from an old version. Your definition of the parameters apart from type are not correct. Have a look at the documentation for a full list of options. In this case I suspect you are fine with just specifying type to be keyword and then use the defaults.

3

thanks for the response, I'll check on that!