error texto and keyowrd illegal_argument_exception

6 views
Skip to first unread message

Ricardo Barros

unread,
Dec 4, 2025, 9:10:27 AM (3 days ago) Dec 4
to Wazuh | Mailing List

I created a new index pattern, and for some reason, every time a new index is created, it assigns some fields as "text". This causes an error saying they should be "keyword" with the message illegal_argument_exception.

Is there a way to make it follow the same standard as Wazuh?

Wazuh default index pattern:

{
  "wazuh-alerts-4.x-2025.06.02": {
    "mappings": {
      "cluster.name": {
        "full_name": "cluster.name",
        "mapping": {
          "name": {
            "type": "keyword"
          }
        }
      }
    }
  }

}


New index pattern I created in Wazuh:

{
  "wazuh-alerts-novo-2025.06.24": {
    "mappings": {
      "cluster.name": {
        "full_name": "cluster.name",
        "mapping": {
          "name": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    }
  }

}
Reply all
Reply to author
Forward
0 new messages