I'm trying to create a template through Kibana from an already imported index, so I can reimport them, and apply the template to them (and also apply a lifecycle policy).
The index mappings looks like this:
{
"mappings": {
"SQLExtendedLogs": {
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"attach_activity_id": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"attach_activity_id_xfer": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"batch_text": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"callstack": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"category": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"component": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"connection_reset_option": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"cpu_time": {
"type": "long"
},
"data": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"data_stream": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"database_id": {
"type": "long"
},
"database_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"destination": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"duration": {
"type": "long"
},
"error_number": {
"type": "long"
},
"fields": {
"properties": {
"logtype": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"global": {
"properties": {
"log": {
"properties": {
"collector": {
"properties": {
"application": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"vendor": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
},
"host": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"is_intercepted": {
"type": "boolean"
},
"logical_reads": {
"type": "long"
},
"message": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"mssql_computer": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"mssql_domain": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"mssql_product_version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"mssql_server_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"mssql_version": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"object_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"opcode": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"output_parameters": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"physical_reads": {
"type": "long"
},
"port": {
"type": "long"
},
"result": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"row_count": {
"type": "long"
},
"server_instance_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"session_id": {
"type": "long"
},
"severity": {
"type": "long"
},
"signal_duration": {
"type": "long"
},
"spills": {
"type": "long"
},
"sql_text": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"state": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"statement": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tsql_stack": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"user_defined": {
"type": "boolean"
},
"username": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"wait_resource": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"wait_type": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"writes": {
"type": "long"
},
"xe_category": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xe_description": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xe_file_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xe_file_offset": {
"type": "long"
},
"xe_session_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xe_severity_keyword": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xe_severity_value": {
"type": "long"
},
"xml_deadlock_report": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"xml_report": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
So I thought I could paste it in as a json to the template mappings, but I get this very long error:
{
"statusCode": 400,
"error": "Bad Request",
"message": "composable template [simulate_template_pakjlx5sqxonel2uzo0vqg] template after composition is invalid",
"attributes": {
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "composable template [simulate_template_pakjlx5sqxonel2uzo0vqg] template after composition is invalid"
}
],
"type": "illegal_argument_exception",
"reason": "composable template [simulate_template_pakjlx5sqxonel2uzo0vqg] template after composition is invalid",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "invalid composite mappings for [simulate_template_pakjlx5sqxonel2uzo0vqg]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [SQLExtendedLogs : {dynamic_templates=[], properties={data={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_category={type=text, fields={keyword={ignore_above=256, type=keyword}}}, logical_reads={type=long}, opcode={type=text, fields={keyword={ignore_above=256, type=keyword}}}, type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_domain={type=text, fields={keyword={ignore_above=256, type=keyword}}}, row_count={type=long}, user_defined={type=boolean}, xml_deadlock_report={type=text, fields={keyword={ignore_above=256, type=keyword}}}, batch_text={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xml_report={type=text, fields={keyword={ignore_above=256, type=keyword}}}, host={type=text, fields={keyword={ignore_above=256, type=keyword}}}, state={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_version={type=text, fields={keyword={ignore_above=256, type=keyword}}}, physical_reads={type=long}, connection_reset_option={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_computer={type=text, fields={keyword={ignore_above=256, type=keyword}}}, signal_duration={type=long}, xe_session_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, callstack={type=text, fields={keyword={ignore_above=256, type=keyword}}}, server_instance_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_severity_value={type=long}, output_parameters={type=text, fields={keyword={ignore_above=256, type=keyword}}}, port={type=long}, wait_type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, fields={type=object, properties={logtype={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}, error_number={type=long}, attach_activity_id_xfer={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_severity_keyword={type=text, fields={keyword={ignore_above=256, type=keyword}}}, wait_resource={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_product_version={type=text, fields={keyword={ignore_above=256, type=keyword}}}, destination={type=text, fields={keyword={ignore_above=256, type=keyword}}}, global={type=object, properties={log={type=object, properties={vendor={type=text, fields={keyword={ignore_above=256, type=keyword}}}, type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, collector={type=object, properties={application={type=text, fields={keyword={ignore_above=256, type=keyword}}}, version={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}}}}}, xe_file_offset={type=long}, duration={type=long}, result={type=text, fields={keyword={ignore_above=256, type=keyword}}}, tsql_stack={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_file_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, object_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, @version={type=text, fields={keyword={eager_global_ordinals=false, norms=false, ignore_above=256, index=true, store=false, type=keyword, split_queries_on_whitespace=false, index_options=docs, doc_values=true}}}, statement={type=text, fields={keyword={ignore_above=256, type=keyword}}}, spills={type=long}, severity={type=long}, cpu_time={type=long}, is_intercepted={type=boolean}, xe_description={type=text, fields={keyword={ignore_above=256, type=keyword}}}, database_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, session_id={type=long}, attach_activity_id={type=text, fields={keyword={ignore_above=256, type=keyword}}}, message={type=text, fields={keyword={ignore_above=256, type=keyword}}}, component={type=text, fields={keyword={ignore_above=256, type=keyword}}}, @timestamp={type=date}, database_id={type=long}, data_stream={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_server_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, category={type=text, fields={keyword={ignore_above=256, type=keyword}}}, writes={type=long}, sql_text={type=text, fields={keyword={ignore_above=256, type=keyword}}}, username={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [SQLExtendedLogs : {dynamic_templates=[], properties={data={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_category={type=text, fields={keyword={ignore_above=256, type=keyword}}}, logical_reads={type=long}, opcode={type=text, fields={keyword={ignore_above=256, type=keyword}}}, type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_domain={type=text, fields={keyword={ignore_above=256, type=keyword}}}, row_count={type=long}, user_defined={type=boolean}, xml_deadlock_report={type=text, fields={keyword={ignore_above=256, type=keyword}}}, batch_text={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xml_report={type=text, fields={keyword={ignore_above=256, type=keyword}}}, host={type=text, fields={keyword={ignore_above=256, type=keyword}}}, state={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_version={type=text, fields={keyword={ignore_above=256, type=keyword}}}, physical_reads={type=long}, connection_reset_option={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_computer={type=text, fields={keyword={ignore_above=256, type=keyword}}}, signal_duration={type=long}, xe_session_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, callstack={type=text, fields={keyword={ignore_above=256, type=keyword}}}, server_instance_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_severity_value={type=long}, output_parameters={type=text, fields={keyword={ignore_above=256, type=keyword}}}, port={type=long}, wait_type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, fields={type=object, properties={logtype={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}, error_number={type=long}, attach_activity_id_xfer={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_severity_keyword={type=text, fields={keyword={ignore_above=256, type=keyword}}}, wait_resource={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_product_version={type=text, fields={keyword={ignore_above=256, type=keyword}}}, destination={type=text, fields={keyword={ignore_above=256, type=keyword}}}, global={type=object, properties={log={type=object, properties={vendor={type=text, fields={keyword={ignore_above=256, type=keyword}}}, type={type=text, fields={keyword={ignore_above=256, type=keyword}}}, collector={type=object, properties={application={type=text, fields={keyword={ignore_above=256, type=keyword}}}, version={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}}}}}, xe_file_offset={type=long}, duration={type=long}, result={type=text, fields={keyword={ignore_above=256, type=keyword}}}, tsql_stack={type=text, fields={keyword={ignore_above=256, type=keyword}}}, xe_file_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, object_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, @version={type=text, fields={keyword={eager_global_ordinals=false, norms=false, ignore_above=256, index=true, store=false, type=keyword, split_queries_on_whitespace=false, index_options=docs, doc_values=true}}}, statement={type=text, fields={keyword={ignore_above=256, type=keyword}}}, spills={type=long}, severity={type=long}, cpu_time={type=long}, is_intercepted={type=boolean}, xe_description={type=text, fields={keyword={ignore_above=256, type=keyword}}}, database_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, session_id={type=long}, attach_activity_id={type=text, fields={keyword={ignore_above=256, type=keyword}}}, message={type=text, fields={keyword={ignore_above=256, type=keyword}}}, component={type=text, fields={keyword={ignore_above=256, type=keyword}}}, @timestamp={type=date}, database_id={type=long}, data_stream={type=text, fields={keyword={ignore_above=256, type=keyword}}}, mssql_server_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, category={type=text, fields={keyword={ignore_above=256, type=keyword}}}, writes={type=long}, sql_text={type=text, fields={keyword={ignore_above=256, type=keyword}}}, username={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}]"
}
}
}
},
...
So it says that it has unsupported parameters, how can it have that when I copy it?
I can see that it creates all the fields, it just can't pass it anyways???