# Warnings in ElasticSearch/Logstash

**URL:** https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566
**Category:** Elasticsearch
**Created:** [November 6, 2017, 5:27pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566 "2017-11-06T17:27:28Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![ElkLogs](https://avatars.discourse-cdn.com/v4/letter/e/a183cd/32.png) [@ElkLogs](https://discuss.elastic.co/u/ElkLogs)
#### Post date: [November 6, 2017, 5:27pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/1 "2017-11-06T17:27:28Z")

</div>

I am getting warnings in the logstash logs that it cant export to elasticsearch. This is probably an issue with a template, but I don't know where to start troubleshooting or which application the problem is actually with. The warning is regarding GeoIP postal codes, and what look like canadian postal codes it fails to parse.

Warning message:

> <https://gist.github.com/anonymous/4445982797b544648eba93b976fa1b83>

Any help is appreciated.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 7, 2017, 12:24am UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/2 "2017-11-07T00:24:10Z")

</div>

What is the mapping on the `DestinationIPGeo.postal_code` field?

---

<div class="post-metadata">

### Author: ![ElkLogs](https://avatars.discourse-cdn.com/v4/letter/e/a183cd/32.png) [@ElkLogs](https://discuss.elastic.co/u/ElkLogs)
#### Post date: [November 7, 2017, 2:56pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/3 "2017-11-07T14:56:40Z")

</div>

I apologize, I am new to ELK stack. If you mean from the template, I do not appear to have a mapping for postal\_code.

I ran the following command:

curl -XGET 'localhost:9200/\_template/traffic?pretty'

This is the output for that section:

> <https://gist.github.com/anonymous/389e043873e502f59c0b99b151ac290c>

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 7, 2017, 7:46pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/4 "2017-11-07T19:46:38Z")

</div>

Try `curl -XGET 'localhost:9200/traffic/_mapping?pretty'`.

---

<div class="post-metadata">

### Author: ![ElkLogs](https://avatars.discourse-cdn.com/v4/letter/e/a183cd/32.png) [@ElkLogs](https://discuss.elastic.co/u/ElkLogs)
#### Post date: [November 7, 2017, 8:39pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/5 "2017-11-07T20:39:11Z")

</div>

The output does include a postal\_code mapping. I dont need postal codes, can that be removed or do I need to change the type? Either way, how can I modify this?

Thank you!

> <https://gist.github.com/anonymous/55e3ffad16757b93bd3eb07555064355>

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 7, 2017, 10:04pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/6 "2017-11-07T22:04:28Z")

</div>

If you don't need it then you can remove it in Logstash, that is the field that is generating the error.

---

<div class="post-metadata">

### Author: ![ElkLogs](https://avatars.discourse-cdn.com/v4/letter/e/a183cd/32.png) [@ElkLogs](https://discuss.elastic.co/u/ElkLogs)
#### Post date: [November 8, 2017, 1:53pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/7 "2017-11-08T13:53:51Z")

</div>

Where is that template physically located, or how do I modify it? I will just remove that section, if I can find how to edit it.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 8, 2017, 8:29pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/8 "2017-11-08T20:29:10Z")

</div>

If you don't want the field at all, then use mutate+remove field.  
If you want to remove it from the template, then you are better off fixing the underlying issue, which is a bit more involved.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 6, 2017, 8:29pm UTC](https://discuss.elastic.co/t/warnings-in-elasticsearch-logstash/106566/9 "2017-12-06T20:29:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.