apielasticsearchindexingkibana-5

Unable to create index in Elastic search using API


I am trying to create index in Elasticsearch using API using the following mapping in kibana dev tools. Once I create the index, I want to use reindex API to copy documents from an already existing index.

        PUT /ipflow-logs
        {
          "ipflow-logs" : {
            "mappings" : {
              "properties" : {
                "conn_state" : {
                  "type" : "keyword"
                },
                "content_length" : {
                  "type" : "long"
                },
                "content_type" : {
                  "type" : "keyword"
                },
                "createdDate" : {
                  "type" : "keyword"
                },
                "dst_ip" : {
                  "type" : "ip"
                },
                "dst_port" : {
                  "type" : "long"
                },
                "duration" : {
                  "type" : "long"
                },
                "history" : {
                  "type" : "keyword"
                },
                "local_orig" : {
                  "type" : "keyword"
                },
                "missed_bytes" : {
                  "type" : "long"
                },
                "orig_bytes" : {
                  "type" : "long"
                },
                "orig_ip_bytes" : {
                  "type" : "long"
                },
                "orig_pkts" : {
                  "type" : "long"
                },
                "protocol" : {
                  "type" : "keyword"
                },
                "resp_bytes" : {
                  "type" : "long"
                },
                "resp_ip_bytes" : {
                  "type" : "long"
                },
                "resp_pkts" : {
                  "type" : "long"
                },
                "service" : {
                  "type" : "keyword"
                },
                "src_ip" : {
                  "type" : "ip"
                },
                "src_port" : {
                  "type" : "long"
                },
                "timestamp" : {
                  "type" : "date",
                  "format" : "yyyy-MM-dd 'T' HH:mm:ss.SSS"
                },
                "uid" : {
                  "type" : "keyword"
                }
              }
            }
          }
        }

I am getting the below error when I try to create the index.

"type": "parse_exception", "reason": "unknown key [ipflow-logs] for create index", "status": 400

Any help is appreciated. Thanks


Solution

  • You need to do it this way (i.e. mappings should be at the top):

    PUT /ipflow-logs
    {
      "mappings": {
        "properties": {
          "conn_state": {
            "type": "keyword"
          },
          "content_length": {
            "type": "long"
          },
          "content_type": {
            "type": "keyword"
          },
          "createdDate": {
            "type": "keyword"
          },
          "dst_ip": {
            "type": "ip"
          },
          "dst_port": {
            "type": "long"
          },
          "duration": {
            "type": "long"
          },
          "history": {
            "type": "keyword"
          },
          "local_orig": {
            "type": "keyword"
          },
          "missed_bytes": {
            "type": "long"
          },
          "orig_bytes": {
            "type": "long"
          },
          "orig_ip_bytes": {
            "type": "long"
          },
          "orig_pkts": {
            "type": "long"
          },
          "protocol": {
            "type": "keyword"
          },
          "resp_bytes": {
            "type": "long"
          },
          "resp_ip_bytes": {
            "type": "long"
          },
          "resp_pkts": {
            "type": "long"
          },
          "service": {
            "type": "keyword"
          },
          "src_ip": {
            "type": "ip"
          },
          "src_port": {
            "type": "long"
          },
          "timestamp": {
            "type": "date",
            "format": "yyyy-MM-dd 'T' HH:mm:ss.SSS"
          },
          "uid": {
            "type": "keyword"
          }
        }
      }
    }