Update Current Index

Elastic Stack Elasticsearch
1

I'm trying to update my index, think I'm following the instructions but still not getting anywhere.

I was trying to my index template to convert lat & long to be geo_points and broke mapping for my host names which contain dashes (thus each segment between dashes was analyzed as a server).

I think I've updated the template properly but the current index is still messed up and I'm trying to resolve that.

The 'put' statement in Sense:

PUT filebeat-2016.07.21/_mapping/nginx-access
{
  "properties": {
    "message": {
      "type": "string",
      "index": "not_analyzed"
    },
    "host": {
      "type": "string"
       , "index": "not_analyzed"
    },
    "server": {
      "type": "string",
      "index": "not_analyzed"
    }
  }
}

And the response I get:

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [server] conflicts with existing mapping in other types:\n[mapper [server] has different [index] values, mapper [server] has different [doc_values] values, cannot change from disabled to enabled, mapper [server] has different [analyzer], mapper [server] is used by multiple types. Set update_all_types to true to update [omit_norms] across all types., mapper [server] is used by multiple types. Set update_all_types to true to update [search_analyzer] across all types., mapper [server] is used by multiple types. Set update_all_types to true to update [search_quote_analyzer] across all types.]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [server] conflicts with existing mapping in other types:\n[mapper [server] has different [index] values, mapper [server] has different [doc_values] values, cannot change from disabled to enabled, mapper [server] has different [analyzer], mapper [server] is used by multiple types. Set update_all_types to true to update [omit_norms] across all types., mapper [server] is used by multiple types. Set update_all_types to true to update [search_analyzer] across all types., mapper [server] is used by multiple types. Set update_all_types to true to update [search_quote_analyzer] across all types.]"
   },
   "status": 400
}

I also use the ?update_all_types command as seen in the above error message and the documentation;

PUT filebeat-2016.07.21/_mapping/nginx-access?update_all_types

{
  "mappings": {
    "nginx-access": {
      "properties": {
        "message": {
          "type": "string",
          "index": "not_analyzed"
        },
        "host": {
          "type": "string"
           , "index": "not_analyzed"
        },
        "server": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

and I get a similar response;

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [server] conflicts with existing mapping in other types:\n[mapper [server] has different [index] values, mapper [server] has different [doc_values] values, cannot change from disabled to enabled, mapper [server] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [server] conflicts with existing mapping in other types:\n[mapper [server] has different [index] values, mapper [server] has different [doc_values] values, cannot change from disabled to enabled, mapper [server] has different [analyzer]]"
   },
   "status": 400
}

Can someone please explain what I'm doing wrong? I've been messing with mappings for weeks now and can't find a guide that explains it. I feel like I'm 80% of the way there, but just need to figure out what I'm doing wrong. Thanks.

2

It seems like in your mapping for "filebeat-2016.07.21" you already have another type with field "server" that has a different analyzer configured. Can you check if this is the case? Different types in an index cannot contain fields with the same name but different configuration (with a few exceptions such as search_analyzer which can be updated with update_all_types=true). Here is an explanation on why that is so: https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping.html

If that is the issue the the only way to have the field being not_analyzed is to reindex "filebeat-2016.07.21".

3

Hi Britta,

You are correct, I also have an 'stunnel' type with 'Server' as an entry. Is there any way I can simply update both at the same time?

Also, if I'm reading the documentation correctly.. in order to reindex, would I use a command similar to:

POST /_bulk
{ "delete": { "_index": "filebeat-2016.07.21"}}
{ "create": { "_index": "filebeat-2016.07.21"}}

Is that correct? Thanks for your help. I'm unfortunately doing this on production data.

4

The documentation you linked to is for indexing documents in bulk. By reindexing I meant create a new index with the desired mapping and then get the documents from the old index and index into the new one. The guide has some helpful instructions for that: https://www.elastic.co/guide/en/elasticsearch/guide/current/reindex.html
If you are using 2.3 you can use the reindex api: https://www.elastic.co/guide/en/elasticsearch/guide/current/reindex.html

Hope that helps.