I'm using Elasticsearch 2.4
Following the instruction from the Elasticsearch Kibana official documentation here, when I create the index logstash-2015.05.18, the error below were emitted.
# curl -XPUT http://10.15.0.70:9200/logstash-2015.05.18 -d '
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
';
{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [“store” : true]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [“date”]: Root mapping definition has unsupported parameters: [“store” : true]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters: [“store” : true]"}},"status":400}
Using the sense plugin of Kibana to create the index also gives me the same error
PUT logstash-2015.05.18
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [“store” : true]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [“date”]: Root mapping definition has unsupported parameters: [“store” : true]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Root mapping definition has unsupported parameters: [“store” : true]"
}
},
"status": 400
}
Can someone tell me did I do something wrong when creating the index?
Had same trouble.
Removing elasticsearch data("/usr/local/var/elasticsearch", if you install it with Homebrew) fixed it for me.
Related
I am trying to change the format of a string field in opensearch:
PUT my_index/_mapping
{
"mappings": {
"properties": {
"timestamp": {
"type": "date",
"format": "YYYY-MM-DD HH:mm:ss.SSS"
}
}
}
}
Response is
{
"error" : {
"root_cause" : [
{
"type" : "mapper_parsing_exception",
"reason" : "Root mapping definition has unsupported parameters: [mappings : {properties={timestamp={format=YYYY-MM-DD HH:mm:ss.SSS, type=date}}}]"
}
],
"type" : "mapper_parsing_exception",
"reason" : "Root mapping definition has unsupported parameters: [mappings : {properties={timestamp={format=YYYY-MM-DD HH:mm:ss.SSS, type=date}}}]"
},
"status" : 400
}
I've spent days trying to figure this out, seems to me like Opensearch is just so unnecessarily complex.
You cannot change the type of an existing field once it's been created. You need to reindex your index with the wrong mapping into a new index with the right mapping.
First, create the new index:
PUT new_index
{
"mappings": {
"properties": {
"timestamp": {
"type": "date",
"format": "YYYY-MM-DD HH:mm:ss.SSS"
}
}
}
}
Then, reindex the old index into the new one
POST _reindex
{
"source": {
"index": "old_index"
},
"dest": {
"index": "new_index"
}
}
Sample document mapping
{
"INDEX_NAME":{
"mappings":{
"_doc":{
"dynamic":"false",
"properties":{
"SOME_OBJECT":{
"type":"object",
"dynamic":true,
"properties":{
"CANDIDATE_ID":{ <----- Incorrectly dynamically mapped as date
"type":"date"
}
}
}
}
}
}
}
}
I want to disable date detection for all the properties of the SOME_OBJECT but not the other fields in the document as ES is incorrectly mapping CANDIDATE_ID as date. The documentation says that you can do it for the index. However, it doesn't tell if we can do it to an object within a doc. For example, I would like to do something like that
{
"INDEX_NAME":{
"mappings":{
"_doc":{
"dynamic":"false",
"properties":{
"SOME_OBJECT":{
"type":"object",
"dynamic":true,
"date_detection": false <-------- THIS
}
}
}
}
}
}
}
However, it throws an exception
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [doc]: Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [cluster_state] has unsupported parameters: [date_detection : false]"
}
},
"status": 400
}
I'm creating mapping for multiple type
here my query
PUT opl_consultation/_mapping
my json mapping file
{
"mappings": {
"article": {
"properties": {
"numero_noeud": { "type": "text" },
"intitule_fr": { "type": "text" },
"path_audio": { "type": "text" }
}
},
"hierarchie": {
"properties": {
"id_type_noeud_hie": { "type": "integer" },
"noeud_numero_hie": { "type": "text" },
"intitule_hie_fr": { "type": "text" }
}
},
"law_type": {
"properties": {
"id_type_loi": { "type": "integer" },
"Desc_law_type": { "type": "text" }
}
}
}
}
below the error a got
"type": "action_request_validation_exception",
"reason": "Validation Failed: 1: mapping type is missing;"
},
"status": 400
}
the version is Elasticsearch\6.4.2
In Elasticsearch 6.4.2 you cannot have more than one mapping type. See https://www.elastic.co/guide/en/elasticsearch/reference/current/removal-of-types.html
If you run your query instead as PUT opl_consultation with your mapping definition you will get the below error
"type": "illegal_argument_exception",
"reason": "Rejecting mapping update to [opl_consultation] as the final mapping would have more than 1 type: [law_type, article, hierarchie]"
Instead, use a custom type field as described here
I want to use percolate query in elasticsearch. But I couldn't setup mapping. I have received the following error. where is my fault?
PUT /my-index
{
"mappings": {
"doctype": {
"properties": {
"message": {
"type": "string"
}
}
},
"queries": {
"properties": {
"query": {
"type": "percolator"
}
}
}
}
}
Error Message:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "No handler for type [percolator] declared on field [query]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [queries]: No handler for type [percolator] declared on field [query]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "No handler for type [percolator] declared on field [query]"
}
},
"status": 400
}
Thanks
I have an index named "myproject-error-2016-08" which has only one type named "error".
When I hit :
GET myproject-error-2016-08/_mapping
It returns following result:
{
"myproject-error-2016-08": {
"mappings": {
"error": {
"properties": {
...
"responseCode": {
"type": "string"
},
...
}
}
}
}
}
I need to update the responseCode to not_analyzed,
hence I am using following following reuest :
PUT myproject-error-2016-08/_mapping/error
{
"properties": {
"responseCode": {
"type": "string",
"index": "not_analyzed"
}
}
}
And getting following exception :
{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
}
],
"type": "illegal_argument_exception",
"reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
},
"status": 400
}
I have also tried following:
PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}
But it returned the same response.
Elastic Search is :
$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91
You cannot change the type of a field once it's been created.
However, you can definitely create a not_analyzed sub-field like this:
PUT myproject-error-2016-08/_mapping/error
{
"properties": {
"responseCode": {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
}
Then you'll need to re-index your data/logs in order to populate that sub-field and you'll be able to reference responseCode.raw in your queries.
UPDATE: Since ES5 not_analyzed string do not exist anymore and are now called keyword:
PUT myproject-error-2016-08/_mapping/error
{
"properties": {
"responseCode": {
"type": "text",
"fields": {
"raw": {
"type": "keyword"
}
}
}
}
}