Error: "Rejecting mapping update to [execbeat-2020.10.18] as the final mapping would have more than 1 type: [_doc, doc]"

[igor-dan]

Hi,
I'm trying to use execbeat with ES7.*.
I know, this is not officially supported but I need it eagerly.
I receive following error:
2020/10/18 16:05:48.429281 client.go:447: WARN Can not index event (status=400): {"type":"illegal_argument_exception","reason":"Rejecting mapping update to [execbeat-2020.10.18] as the final mapping would have more than 1 type: [_doc, doc]"}
Can you give me a hint what may be the problem ?
Thanks a lot

[igor-dan]

I succeeded to resolve this issue.
Thanks for good tool :-)

[siliconberry]

Hi @igor-dan Can you please help me to work with ES7 ?

[juliennix]

@igor-dan , if you could share how you managed, it will be appreciated.
Kr,

[juliennix]

@siliconberry , using the following mapping request (include_type_name is important) make it work:

PUT _template/execbeat?include_type_name=true 
{
  "mappings": {
    "doc": {
      "properties": {
        "beat": {
          "properties": {
            "hostname": {
              "type": "text"
            },
            "name": {
              "type": "text"
            },
            "version": {
              "type": "text"
            }
          }
        },
        "exec": {
          "properties": {
            "command": {
              "type": "text"
            },
            "exitCode": {
              "type": "long"
            },
            "stderr": {
              "type": "text"
            },
            "stdout": {
              "type": "text"
            }
          }
        }
      }
    }
  },
  "order": 0,
  "settings": {
    "index.mapping.total_fields.limit": 10000,
    "index.refresh_interval": "5s"
  },
  "template": "execbeat-*"
}

[christiangalsterer]

I just started to work on a version compatible with 7.x. As there was no activity for a longer period of time, there are quite some changes to apply, but I'm confident to make it happen, see also #37.