Elasticsearch: ALLOCATION_FAILED Field [user] is defined as a field in mapping [syslog]

[jairagoo]

Hello,
I am receiving this issue on elasticsearch.log:
[2016-02-16 16:50:41,109][WARN ][indices.cluster ] 256}}},,,,,"user":{"type":"string","norms":{"enabled":false},"fielddata":{"format":"enabled"},"fields":{"raw":{"type":"string","index":"not_analyzed","ignore_above":256}}}}}}]
java.lang.IllegalArgumentException: Field [user] is defined as a field in mapping [syslog] but this name is already used for an object in other types

FROM Head:
"unassigned_info": {
"reason": "ALLOCATION_FAILED",
"at": "2016-02-16T21:38:01.695Z",
"details": "failed to update mappings, failure IllegalArgumentException[Field [user] is defined as a field in mapping [syslog] but this name is already used for an object in other types]"

I imagine that I have to modify a template somewhere, but not sure how to do so. Any guidance would be appreciated.
I am running Elasticsearch 2.2 and logstash 2.1.
Best,
~Jai

[saravanp]

I am seeing the same issue as well

-Saravan

[palmerabollo]

See https://discuss.elastic.co/t/how-to-solve-field-in-mapping-but-already-used-in-other-types/43067/3
They suggest to use different indexes, but I'd like to know a better solution, too.

[clintongormley]

Hi all

As of 2.0.0, fields with the same name in different types in the same index must have the same mapping. This was part of a bigger change (see #8870) to clean up numerous problems with mappings. Your two alternatives are: use separate indices or rename one of the fields.

[codemariner]

fwiw, this problem only recently cropped up for us after updating from 2.1 to 2.3. We didn't update the mappings for the problem fields and have been running fine on 2.1 for some months now.

[clintongormley]

@codemariner there were various bugs in earlier 2.x versions which still allowed conflicting mappings to be added.