elasticsearch mapper_parsing_exception Root mapping definition has unsupported parameters

Question

I'm having the following issue with elasticsearch 7 when trying creating a template.

When I'm trying to copy template from elasticsearch 6 to 7 and some of the fields I have removed as per the elasticsearch 7 .e

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
    }
  },
  "status": 400
}

Mapping template: The following is the template I'm trying to post.

POST _template/logstash
{
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "mapper" : {

        }
      }
    },
    "mappings" : {
      "events" : {
        "properties" : {
          "msg" : {
            "type" : "text",
            "fields" : {
              "raw" : {
                "type" : "keyword"
              }
            }
          },
          "requestId" : {
            "type" : "keyword"
          },
          "logger" : {
            "type" : "keyword"
          },
          "host" : {
            "type" : "keyword"
          },
          "jwtOwner" : {
            "type" : "keyword"
          },
          "requestOriginator" : {
            "type" : "keyword"
          },
          "tag" : {
            "analyzer" : "firsttoken",
            "fields" : {
              "disambiguator" : {
                "analyzer" : "keyword",
                "type" : "text"
              }
            }
          },
          "jwtAuthenticatedUser" : {
            "type" : "keyword"
          },
          "thread" : {
            "type" : "keyword"
          },
          "requestChainOriginator" : {
            "type" : "keyword"
          },
          "revision" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  }

Please help me resolve the issue. Thanks in advance.

Val · Accepted Answer · 2020-03-12 20:14:41Z

1

There are two issues. One issue is the one mentioned by @OpsterESNinjaKamal

But it still won't work as the tag field has no type.

Here is the template that will work:

PUT _template/logstash
{
  "order": 0,
  "index_patterns": [
    "logstash*"
  ],
  "settings": {
    "index": {
      "analysis": {
        "filter": {
          "firsttoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^([^\\.]*)\\.?.*$"
            ]
          },
          "secondtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          },
          "thirdtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          }
        },
        "analyzer": {
          "firsttoken": {
            "filter": [
              "firsttoken"
            ],
            "tokenizer": "keyword"
          },
          "secondtoken": {
            "filter": [
              "secondtoken"
            ],
            "tokenizer": "keyword"
          },
          "thirdtoken": {
            "filter": [
              "thirdtoken"
            ],
            "tokenizer": "keyword"
          }
        }
      },
      "mapper": {}
    }
  },
  "mappings": {
    "properties": {
      "msg": {
        "type": "text",
        "fields": {
          "raw": {
            "type": "keyword"
          }
        }
      },
      "requestId": {
        "type": "keyword"
      },
      "logger": {
        "type": "keyword"
      },
      "host": {
        "type": "keyword"
      },
      "jwtOwner": {
        "type": "keyword"
      },
      "requestOriginator": {
        "type": "keyword"
      },
      "tag": {
        "type": "text",                    <--- add type here
        "analyzer": "firsttoken",
        "fields": {
          "disambiguator": {
            "analyzer": "keyword",
            "type": "text"
          }
        }
      },
      "jwtAuthenticatedUser": {
        "type": "keyword"
      },
      "thread": {
        "type": "keyword"
      },
      "requestChainOriginator": {
        "type": "keyword"
      },
      "revision": {
        "type": "keyword"
      }
    }
  },
  "aliases": {}
}

answered Mar 12, 2020 at 20:14

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Kamal Kunjapur Over a year ago

oh yes!! @tag field. I missed it. Thank you Val for answering this. Amazing catch!!

Rama Krishna S Over a year ago

Sorry vol I missed adding events template that im using.

Val Over a year ago

I don't get it ?

Kamal Kunjapur · Accepted Answer · 2020-03-12 20:09:05Z

Notice your mappings. ES post version 7.0, doesn't support type i.e. events in this case and that is has been deprecated.

Post version 7.0, you would need to create a separate index for every type you've had in the index prior to version 7.0.

This link should help you as how you can migrate from version 6.x to 7.x

Basically your mappings section would be as follows:

{
   "mappings":{
      "properties":{                     <---- Notice there is no `events` before `properties` as mentioned in your question
         "msg":{
            "type":"text",
            "fields":{
               "raw":{
                  "type":"keyword"
               }
            }
         },
         "requestId":{
            "type":"keyword"
         },
         "logger":{
            "type":"keyword"
         },
         "host":{
            "type":"keyword"
         },
         "jwtOwner":{
            "type":"keyword"
         },
         "requestOriginator":{
            "type":"keyword"
         },
         "tag":{
            "analyzer":"firsttoken",
            "fields":{
               "disambiguator":{
                  "analyzer":"keyword",
                  "type":"text"
               }
            }
         },
         "jwtAuthenticatedUser":{
            "type":"keyword"
         },
         "thread":{
            "type":"keyword"
         },
         "requestChainOriginator":{
            "type":"keyword"
         },
         "revision":{
            "type":"keyword"
         }
      }
   }
}

Rama Krishna S · Accepted Answer · 2020-03-13 12:52:48Z

Sorry, Vol and Opster I missed adding events template. I deleted the event because it is not accepting. The following is the template for events.

PUT  _template/logstash
{
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "mapper" : {

        }
      }
    },
    "mappings" : {
      "events" : {
        "properties" : {
          "msg" : {
            "type" : "text",
            "fields" : {
              "raw" : {
                "type" : "keyword"
              }
            }
          },
          "requestId" : {
            "type" : "keyword"
          },
          "logger" : {
            "type" : "keyword"
          },
          "host" : {
            "type" : "keyword"
          },
          "jwtOwner" : {
            "type" : "keyword"
          },
          "requestOriginator" : {
            "type" : "keyword"
          },
          "tag" : {
            "analyzer" : "firsttoken",
            "fields" : {
              "disambiguator" : {
                "analyzer" : "keyword",
                "type" : "text"
              }
            },
            "type" : "text"
          },
          "jwtAuthenticatedUser" : {
            "type" : "keyword"
          },
          "thread" : {
            "type" : "keyword"
          },
          "requestChainOriginator" : {
            "type" : "keyword"
          },
          "revision" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  }

Collectives™ on Stack Overflow

elasticsearch mapper_parsing_exception Root mapping definition has unsupported parameters

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related