Disable date detection for an object in Elasticsearch - elasticsearch

Sample document mapping
{
"INDEX_NAME":{
"mappings":{
"_doc":{
"dynamic":"false",
"properties":{
"SOME_OBJECT":{
"type":"object",
"dynamic":true,
"properties":{
"CANDIDATE_ID":{ <----- Incorrectly dynamically mapped as date
"type":"date"
}
}
}
}
}
}
}
}
I want to disable date detection for all the properties of the SOME_OBJECT but not the other fields in the document as ES is incorrectly mapping CANDIDATE_ID as date. The documentation says that you can do it for the index. However, it doesn't tell if we can do it to an object within a doc. For example, I would like to do something like that
{
"INDEX_NAME":{
"mappings":{
"_doc":{
"dynamic":"false",
"properties":{
"SOME_OBJECT":{
"type":"object",
"dynamic":true,
"date_detection": false <-------- THIS
}
}
}
}
}
}
}
However, it throws an exception
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [doc]: Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]"
}
},
"status": 400
}

Related

How to update field format in Opensearch/Elasticsearch?

I am trying to change the format of a string field in opensearch:
PUT my_index/_mapping
{
"mappings": {
"properties": {
"timestamp": {
"type": "date",
"format": "YYYY-MM-DD HH:mm:ss.SSS"
}
}
}
}
Response is
{
"error" : {
"root_cause" : [
{
"type" : "mapper_parsing_exception",
"reason" : "Root mapping definition has unsupported parameters: [mappings : {properties={timestamp={format=YYYY-MM-DD HH:mm:ss.SSS, type=date}}}]"
}
],
"type" : "mapper_parsing_exception",
"reason" : "Root mapping definition has unsupported parameters: [mappings : {properties={timestamp={format=YYYY-MM-DD HH:mm:ss.SSS, type=date}}}]"
},
"status" : 400
}
I've spent days trying to figure this out, seems to me like Opensearch is just so unnecessarily complex.
You cannot change the type of an existing field once it's been created. You need to reindex your index with the wrong mapping into a new index with the right mapping.
First, create the new index:
PUT new_index
{
"mappings": {
"properties": {
"timestamp": {
"type": "date",
"format": "YYYY-MM-DD HH:mm:ss.SSS"
}
}
}
}
Then, reindex the old index into the new one
POST _reindex
{
"source": {
"index": "old_index"
},
"dest": {
"index": "new_index"
}
}

elasticsearch mapping issue: failed to parse field

I have this mapping
PUT /mytest
{
"mappings":{
"properties": {
"value": { "type": "object" }
}
}
}
When I insert this document
POST /mytest/_doc/4
{
"value": { "value": "test"}
}
I got the following error:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "failed to parse field [value.value] of type [long] in document with id '4'. Preview of field's value: 'test'"
}
],
"type": "mapper_parsing_exception",
"reason": "failed to parse field [value.value] of type [long] in document with id '4'. Preview of field's value: 'test'",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "For input string: \"test\""
}
},
"status": 400
}
I know the naming convention is bad, still, this is a valid JSON request, not sure why it doesn't allow it.
This error is telling you that you don't have a mapping for the property value within your value object property. The below example would property set the value.value property within your mytest index:
PUT mytest
{
"mappings": {
"properties": {
"value": {
"type": "object",
"properties": {
"value": {
"type": "text"
}
}
}
}
}
}
However, I don't think that's what your intention was. As a best practice, try following the Elastic Common Schema (ECS) for naming your index properties.

change elasticsearch mapping

I am trying to change the mapping using following code:
PUT /in_test/_mapping/keyword
{
"properties" : {
"term" : {
"type" : "text",
"index" : "not_analyzed"
}
}
}
But it is giving an error:
{
"error": {
"root_cause": [
{
"type": "remote_transport_exception",
"reason": "[tiebreaker-0000000000][172.17.0.24:19555][indices:admin/mapping/put]"
}
],
"type": "illegal_argument_exception",
"reason": "Could not convert [term.index] to boolean",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Failed to parse value [not_analyzed] as only [true] or [false] are allowed."
}
},
"status": 400
}
I also tried to recreate the index
by:
PUT /in_test
{
"mappings" : {
"keyword" : {
"properties" : {
"term" : {
"type" : "text",
"index" : "not_analyzed"
}
}
}
}
}
but I got:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [keyword]: Could not convert [term.index] to boolean"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [keyword]: Could not convert [term.index] to boolean",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Could not convert [term.index] to boolean",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Failed to parse value [not_analyzed] as only [true] or [false] are allowed."
}
}
},
"status": 400
}
I also tried to change the _type to keywords but it is still not working.
Basically, I want to search for exact match of string and for that I am referring to this:
https://www.elastic.co/guide/en/elasticsearch/guide/current/_finding_exact_values.html#_term_query_with_text
That documentation page is from Elasticsearch version 2.X (See at the top of the page), and is no longer correct for modern versions of Elasticsearch.
The error you're getting is because "index" now only accepts true or false, and refers to whether or not the property is indexed at all - Since you're searching by this property, you want it to be true (the default).
Instead, try setting the type to "keyword" and it won't be tokenized. https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-keyword-analyzer.html#_definition_5
PUT /in_test
{
"mappings" : {
"keyword" : {
"properties" : {
"term" : {
"type" : "keyword"
}
}
}
}
}

Elasticsearch percolate mapping error

I want to use percolate query in elasticsearch. But I couldn't setup mapping. I have received the following error. where is my fault?
PUT /my-index
{
"mappings": {
"doctype": {
"properties": {
"message": {
"type": "string"
}
}
},
"queries": {
"properties": {
"query": {
"type": "percolator"
}
}
}
}
}
Error Message:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "No handler for type [percolator] declared on field [query]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [queries]: No handler for type [percolator] declared on field [query]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "No handler for type [percolator] declared on field [query]"
}
},
"status": 400
}
Thanks

Can not create Elasticsearch Index (logstash-2015.05.18)

I'm using Elasticsearch 2.4
Following the instruction from the Elasticsearch Kibana official documentation here, when I create the index logstash-2015.05.18, the error below were emitted.
# curl -XPUT http://10.15.0.70:9200/logstash-2015.05.18 -d '
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
';
{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [“store” : true]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [“date”]: Root mapping definition has unsupported parameters: [“store” : true]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [“store” : true]"}},"status":400}
Using the sense plugin of Kibana to create the index also gives me the same error
PUT logstash-2015.05.18
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [“store” : true]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [“date”]: Root mapping definition has unsupported parameters: [“store” : true]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [“store” : true]"
}
},
"status": 400
}
Can someone tell me did I do something wrong when creating the index?
Had same trouble.
Removing elasticsearch data("/usr/local/var/elasticsearch", if you install it with Homebrew) fixed it for me.

Resources