Rejecting mapping update to [...] as the final mapping would have more than 1 type

[Big-ED]

Does this issue relate to a new feature or an existing bug?

• Bug
• New Feature

What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package.
"Elasticsearch.Net" Version="6.2.0"
"Serilog" Version="2.7.1"
"Serilog.Extensions.Logging" Version="2.0.2"
"Serilog.Sinks.Elasticsearch" Version="6.5.0"

What is the target framework and operating system? See [target frameworks]

• netCore 2.0
• netCore 1.0
• 4.7
• 4.6.x
• 4.5.x

Elastic version
6.3

Kibana version
6.3

Please describe the current behavior?

Elasticsearch index created, but on send event, message appears in selflog:

2018-07-03T18:12:50.8104036Z Failed to store event with template '{HostingRequestStartingLog:l}' into Elasticsearch. Elasticsearch reports for index logstash-2018.07.03 the following: {"type":"illegal_argument_exception","reason":"Rejecting mapping update to [logstash-2018.07.03] as the final mapping would have more than 1 type: [doc, logevent]"}

Please describe the expected behavior?
Event sent succesfully

If the current behavior is a bug, please provide the steps to reproduce the issue and if possible a minimal demo of the problem

        public Startup(IHostingEnvironment env)
        {
            IConfigurationBuilder builder = new ConfigurationBuilder()
                .SetBasePath(env.ContentRootPath)
                .AddJsonFile(ConfigFileName, optional: false, reloadOnChange: true)
                .AddEnvironmentVariables();
            Configuration = builder.Build();
            
            String elasticUri = Configuration["Elastic:Uri"];

            Log.Logger = new LoggerConfiguration().WriteTo
                .Elasticsearch(new ElasticsearchSinkOptions(new Uri(elasticUri))
                {
                    AutoRegisterTemplate = true,
                    AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv6,
                    
                    FailureCallback = e =>
                    {
                        Console.WriteLine("Unable to submit event " + e.MessageTemplate);
                    },
                    EmitEventFailure = EmitEventFailureHandling.WriteToSelfLog |
                                       EmitEventFailureHandling.WriteToFailureSink |
                                       EmitEventFailureHandling.RaiseCallback,

                }).CreateLogger();
            Serilog.Debugging.SelfLog.Enable(message => Console.WriteLine(message));
        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
        {
            loggerFactory.AddSerilog();
            app.UseMvc();
        }

[Big-ED]

Minimal example based on sample from this repo:

sample.zip

Also I tried minimal example with AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv6

Hope to your help :)

[Big-ED]

Finally, I decided to downgrade to elastic and kibana v 6.2.4 and it's work

[waldo2188]

I have the same problem.
serilog-sinks-elasticsearch : 6.5.0
Elastic version : 6.3
Kibana version : 6.3

When I try manually to add data to the index, elasticsearch return this error.

{
  "took" : 3,
  "errors" : true,
  "items" : [
    {
      "index" : {
        "_index" : "myapi-2018.07.09",
        "_type" : "logevent",
        "_id" : null,
        "status" : 400,
        "error" : {
          "type" : "mapper_parsing_exception",
          "reason" : "Failed to parse mapping [_default_]: No handler for type [string] declared on field [message]",
          "caused_by" : {
            "type" : "mapper_parsing_exception",
            "reason" : "No handler for type [string] declared on field [message]"
          }
        }
      }
    },
    {
      "index" : {
        "_index" : "myapi-2018.07.09",
        "_type" : "logevent",
        "_id" : null,
        "status" : 400,
        "error" : {
          "type" : "mapper_parsing_exception",
          "reason" : "Failed to parse mapping [_default_]: No handler for type [string] declared on field [message]",
          "caused_by" : {
            "type" : "mapper_parsing_exception",
            "reason" : "No handler for type [string] declared on field [message]"
          }
        }
      }
    }
  ]
}

I' can't go back to 6.2.4 and I'm not very comfortable with elasticsarch, so how can we fix this issue ?

[waldo2188]

I've find a way to fix my issue.
I've just delete the serilog-events-template template and all work again.

curl -XDELETE http://elasticsearch:9200/_template/serilog-events-template?pretty

[Settler]

I've found workaround for this issue.
I've added typeName=_doc to Serilog config. So my config now looks like:

{
  "Serilog": {
    "WriteTo": [{
        "Name": "Elasticsearch",
        "Args": {
          "nodeUris": "http://localhost:9200;http://remotehost:9200/",
          "indexFormat": "custom-index-{0:yyyy.MM}",
          "templateName": "myCustomTemplate",
          "typeName": "_doc", // !!!
          "inlineFields": false,
        }
    }]
  }
}

Also it could be necessary to delete current logs, which were written by Serilog.

[mivano]

Old issue, cleaning up. Still facing this issue, feel free to reopen.

[uveta]

This issue occurred to me when logging to the same Elasticsearch cluster from multiple services, which use mixed sink versions. Turns out there is a discrepancy between underlying type used to index documents, which changed from sink version 7.x (default typeName was 'logevent') to 8.x (default typeName changed to '_doc').

71dd3c7?branch=71dd3c7ee3d340d6ac95458693ba15a894992866&diff=unified#diff-7011c91a8c65a59fc75f6e4c81e8df9f

If you are using Elasticsearch 7 and above it will reject mapping update, as only one type is allowed per index.

Upgrading all services to use Elasticsearch sink 8.x fixed the issue.