Unable to index with below error

Elastic Stack Logstash
1

Hi Team,

I am facing an error while ingesting logs in elasticsearch.

[2021-02-24T10:44:15,640][WARN ][logstash.outputs.elasticsearch][main][69d9e547a776f45c4f2e9d8533dceb1247bd41e30f7abf5602145295741669ba] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"net-2021.02.24", :routing=>nil, :_type=>"doc"}, #<LogStash::Event:0x415eaf58>], :response=>{"index"=>{"_index"=>"dmarc-2021.02.24", "_type"=>"doc", "_id"=>"MoB10ncBdEzm8CaFi734", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [geoip.latitude] cannot be changed from type [half_float] to [float]"}}}}

My mapping file is

{
  "index_patterns" : "net-*",
  "version" : 60001,
  "settings" : {
    "index.refresh_interval" : "5s",
    "number_of_shards": 1
  },
  "mappings" : {
    "dynamic_templates" : [ {
      "message_field" : {
        "path_match" : "message",
        "match_mapping_type" : "string",
        "mapping" : {
          "type" : "text",
          "norms" : false
        }
      }
    }, {
      "string_fields" : {
        "match" : "*",
        "match_mapping_type" : "string",
        "mapping" : {
          "type" : "text", "norms" : false,
          "fields" : {
            "keyword" : { "type": "keyword", "ignore_above": 256 }
          }
        }
      }
    } ],
    "properties" : {
      "@timestamp": { "type": "date"},
      "@version": { "type": "keyword"},
      "geoip"  : {
        "dynamic": true,
        "properties" : {
          "source_ip": { "type": "ip" },
          "location" : { "type" : "geo_point" },
         "latitude" : { "type" : "half_float" },
          "longitude" : { "type" : "half_float" }
      }
    }
  }
}

Then even I changed to float in my template, delete the complete index but the result is same.

Can someone pls help?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.