], :response=>{"index"=>{"_index"=>"cucm-cdr-21.09.2018", "_type"=>"doc", "_id"=>"-1F6-mUB7q-Yw141ZWFT", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [cucm-cdr-21.09.2018] as the final mapping would have more than 1 type: [cucm-cdr, doc]"}}}}`
Where is the type **doc** getting set and more importantly how do I get rid of it? Thanks in advance!
---
### Author:  [@jakelandis](https://discuss.elastic.co/u/jakelandis)
#### Post date: [September 21, 2018, 3:55pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477/2 "2018-09-21T15:55:58Z")
I think your Logstash elasticsearch output needs to declare the `document_type`, it will send `doc` by default.
```auto
output{
elasticsearch {
...
index => "%{type}-%{+dd.MM.YYYY}"
document_type => "cucm-cdr"
manage_template => false # since not using logstash's default mappings
}
}
```
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document\_type](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-document_type)
---
### Author:  [@rouble](https://discuss.elastic.co/u/rouble)
#### Post date: [September 21, 2018, 4:36pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477/3 "2018-09-21T16:36:53Z")
Thanks @jakelandis
That helped get me closer. But still running into one issue. The first time this ran, it ran fine. But I had some other config issues. So, I flushed/deleted the indexes and restarted logstash. My logstash has sincedb\_path =\> "/dev/null" so it tries to load the files again. Now, I get a strange error, notice the \_type is correct this time, but same multiple key error.
`[2018-09-21T12:29:14,656][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"cucm-cdr-21.09.2018", :_type=>"cucm-cdr", :_routing=>nil}, #], :response=>{"index"=>{"_index"=>"cucm-cdr-21.09.2018", "_type"=>"cucm-cdr", "_id"=>"VFL2_GUB7q-Yw141vk09", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [cucm-cdr-21.09.2018] as the final mapping would have more than 1 type: [cucm-cdr, doc]"}}}}`
---
### Author:  [@jakelandis](https://discuss.elastic.co/u/jakelandis)
#### Post date: [September 21, 2018, 5:07pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477/4 "2018-09-21T17:07:46Z")
It's sending the right type now (at least for the posted snippet). I wonder if something else is feeding that index with the `doc` type. I would suggest to delete that index and from the config you updated, and from that Logstash you changed, temporarily change the index name, then see if the old index name comes back up (which means something else is writing to it with a different type).
---
### Author:  [@rouble](https://discuss.elastic.co/u/rouble)
#### Post date: [September 21, 2018, 5:22pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477/5 "2018-09-21T17:22:02Z")
So, here is what I did, and it works. I set the document\_type to doc - which should be the default (i thought). If @jakelandis or someone else at elastic can explain why this works, it would be much appreciated. In fact, I dont understand why multiple types is even an issue here since nothing in this configuration is trying to set multiple types.
Here is what I did (based on the inspiration from @jakelandis) :
```
output {
if [type] == "cucm-cdr" {
elasticsearch { hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+dd.MM.YYYY}"
document_type => "doc"
manage_template => false # since not using logstash's default mappings
}
} else if [type] == "cucm-cmr"{
elasticsearch { hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+dd.MM.YYYY}"
document_type => "doc"
manage_template => false # since not using logstash's default mappings
}
} else {
elasticsearch { hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+dd.MM.YYYY}"
}
}
}
```
Here is the original config that did not work:
```
elasticsearch { hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+dd.MM.YYYY}"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2018, 5:22pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477/6 "2018-10-19T17:22:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.