{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [err_icmp_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [xlate_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [reason : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_src_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_src_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_severity : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [protocol : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [cisco_message : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [tcp_flags : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_dst_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [host : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [action : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_code : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_code_xlated : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_seq_num : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [sysloghost : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_mapped_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_dst_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_protocol : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_severity_code : {type=long}] [err_src_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_facility : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_dst_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_mapped_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [tags : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_dst_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_xlated_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [interval : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hashcode1 : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hashcode2 : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [policy_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_xlated_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_current_burst : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_ip : {type=ip}] [err_icmp_code : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_total_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_mapped_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_max_burst : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_mapped_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [duration : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_ip : {type=ip}] [@version : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hit_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [direction : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_src_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_pri : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [timestamp : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_max_avg : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_current_avg : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [geoip : {properties={timezone={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ip={type=text, fields={keyword={ignore_above=256, type=keyword}}}, latitude={type=float}, continent_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}, city_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, country_code2={type=text, fields={keyword={ignore_above=256, type=keyword}}}, country_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, dma_code={type=long}, country_code3={type=text, fields={keyword={ignore_above=256, type=keyword}}}, location={properties={lon={type=float}, lat={type=float}}}, region_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, postal_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}, longitude={type=float}, region_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}] [ciscotag : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_facility_code : {type=long}] [dst_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [message : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [bytes : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_count_max : {type=text, fields={keyword={ignore_above=256, type=keyword}}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Root mapping definition has unsupported parameters:  [err_icmp_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [xlate_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [reason : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_src_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_src_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_severity : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [protocol : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [cisco_message : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [tcp_flags : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_dst_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [host : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [action : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_code : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_code_xlated : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_seq_num : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [sysloghost : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_mapped_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_dst_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_protocol : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_severity_code : {type=long}] [err_src_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_facility : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_dst_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_mapped_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [tags : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [orig_dst_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_xlated_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [interval : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hashcode1 : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hashcode2 : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [icmp_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [policy_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_xlated_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_current_burst : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_ip : {type=ip}] [err_icmp_code : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_total_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_mapped_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_max_burst : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_mapped_ip : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [duration : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_ip : {type=ip}] [@version : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [hit_count : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [direction : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [err_src_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_pri : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [timestamp : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_max_avg : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_rate_current_avg : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [geoip : {properties={timezone={type=text, fields={keyword={ignore_above=256, type=keyword}}}, ip={type=text, fields={keyword={ignore_above=256, type=keyword}}}, latitude={type=float}, continent_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}, city_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, country_code2={type=text, fields={keyword={ignore_above=256, type=keyword}}}, country_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, dma_code={type=long}, country_code3={type=text, fields={keyword={ignore_above=256, type=keyword}}}, location={properties={lon={type=float}, lat={type=float}}}, region_name={type=text, fields={keyword={ignore_above=256, type=keyword}}}, postal_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}, longitude={type=float}, region_code={type=text, fields={keyword={ignore_above=256, type=keyword}}}}}] [ciscotag : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [syslog_facility_code : {type=long}] [dst_interface : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [message : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [drop_type : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [src_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_id : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [bytes : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [dst_port : {type=text, fields={keyword={ignore_above=256, type=keyword}}}] [connection_count_max : {type=text, fields={keyword={ignore_above=256, type=keyword}}}]"
  },
  "status": 400
}