The final mapping would have more than 1 type Error - Intermittent

Hi Team,

I am currently observing the below error. Strangely, it worked for the first time, later on I had to an additional field (Tag) to my data and that was the only change I have done and now i get the mapping error. I was not able to figure out the reason behind it and now when i remove the field i added, I still get this error. ELK version - 6.2.3

Error:

[2018-03-23T06:15:30,271][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x6ac12f62>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"sffsf_HFKJ_sajfkjf6", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [healthccms-2018.03.23] as the final mapping would have more than 1 type: [my_doc, doc]"}}}}

Update 2:
When i changed my mappings name to doc, i get the below error. I see there is nothing relevant to the error i got and the template i have.

[2018-03-23T06:46:57,483][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"healthccms-2018.03.23", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x3a60947e>], :response=>{"index"=>{"_index"=>"healthccms-2018.03.23", "_type"=>"doc", "_id"=>"gjYcU2IB9pgc1BKZxkks", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Could not convert [message.index] to boolean", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Failed to parse value [not_analyzed] as only [true] or [false] are allowed."}}}}}}

My Mapping Template:

{
  "template" : "healthccms-*",
  "settings" : {
    "index.refresh_interval" : "10s"
  },
 "mappings" : {
     "my_doc": {
	   "dynamic_templates" : [
          {
            "message_field" : {
              "path_match" : "message",
              "mapping" : {
               "type" : "keyword", "index" : "not_analyzed", "omit_norms" : true
           },
              "match_mapping_type" : "string"
            }
          },
          
		  {
		    "integers": {
            "match_mapping_type": "long",
            "mapping": {
              "type": "integer"
            }
          }
        },
		  
		  {
            "string_fields" : {
              "mapping" : {
                "type" : "text", "index" : "analyzed", "norms": false,
                "fields" : {
                  "keyword" : {"type": "keyword", "index" : "not_analyzed", "ignore_above" : 1024}
                }
              },
              "match_mapping_type" : "string",
              "match" : "*"
            }
          }
        ],
      
       
  "properties" : {
"@timestamp" : { "format" : "dateOptionalTime","type" : "date" },
"@version":{ "type": "keyword" },
"host": { "type": "keyword" },
"path": { "type": "keyword" },
"ETime": { "type": "date", "format" : "dateOptionalTime" },
"OverAllStatus": { "type": "integer" },
"Env": { "type": "keyword" },
"HostAddress": { "type": "keyword" },
"ThresholdDiskSpace": { "type": "keyword" },
"Tag": { "type": "integer" }
    
       }
    }
  }
}

I see in the documentation that the mapping contains more than 1 type, i actually didn't understand what does that mean. Can someone help me understand what is the issue in the template and how can i overcome it.

1 Like

It looks like you might be using the mapping syntax from an old version. Your definition of the parameters apart from type are not correct. Have a look at the documentation for a full list of options. In this case I suspect you are fine with just specifying type to be keyword and then use the defaults.

thanks for the response, I'll check on that!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.