elasticsearch update mapping conflict exception

Question

I have an index named "myproject-error-2016-08" which has only one type named "error".

When I hit :

GET myproject-error-2016-08/_mapping

It returns following result:

{
   "myproject-error-2016-08": {
      "mappings": {
         "error": {
            "properties": {
               ...
               "responseCode": {
                  "type": "string"
               },
               ...
            }
         }
      }
   }
}

I need to update the responseCode to not_analyzed, hence I am using following following reuest :

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "index": "not_analyzed"
      }
   }
}

And getting following exception :

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
   },
   "status": 400
}

I have also tried following:

PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}

But it returned the same response.

Elastic Search is :

$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91

Answer 1

You cannot change the type of a field once it's been created.

However, you can definitely create a not_analyzed sub-field like this:

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

Then you'll need to re-index your data/logs in order to populate that sub-field and you'll be able to reference responseCode.raw in your queries.

UPDATE: Since ES5 not_analyzed string do not exist anymore and are now called keyword:

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "text",
         "fields": {
            "raw": {
               "type": "keyword"
            }
         }
      }
   }
}