as the final mapping would have more than 1 type

ES报错

[2023-05-30T14:35:17,167][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"radar_site", :_type=>"doc", :routing=>nil}, #<LogStash::Event:0x7e0c95e4>], :response=>{"index"=>{"_index"=>"radar_site", "_type"=>"doc", "_id"=>"SG1ea4gB2MD_AMQkOI7O", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Rejecting mapping update to [radar_site] as the final mapping would have more than 1 type: [doc, radar_site]"}}}}

Logstash传输数据到ES的时候，会动态添加字段，默认使用doc这个type添加字段。但是ES 的 index使用的是"radar_site"作为type。type的名称不一致，报错

只要配置一下logstash的type，与ES上的type一致即可。查询官方网站，ES output插件有 document_type 这个字段，加上去就没问题了 

Elasticsearch output plugin | Logstash Reference [7.0] | Elastic

Logstash 配置