Elastic 7 mapping definition has unsupported parameters - database

Question

I believe this issue has to do with the different syntax from elasticsearch 6.x -> 7.x
This is my first time using elasticsearch and havent been able to understand where the issue is.
How would I fix my mapping?
{
"settings": {
"analysis": {
"analyzer": {
"ssdeep_analyzer": {
"tokenizer": "ssdeep_tokenizer"
}
},
"tokenizer": {
"ssdeep_tokenizer": {
"type": "ngram",
"min_gram": 7,
"max_gram": 7,
"token_chars": [
"letter",
"digit",
"symbol"
]
}
}
}
},
"mappings": {
"_default_": {
"_all": {
"enabled": false
},
"dynamic": "strict",
"properties": {
"chunksize": {
"type": "integer"
},
"chunk": {
"analyzer": "ssdeep_analyzer",
"type": "text"
},
"double_chunk": {
"analyzer": "ssdeep_analyzer",
"type": "text"
},
"ssdeep": {
"type": "keyword"
},
"sha256": {
"type": "keyword"
}
}
},
"record": {}
}
}
The error that is being raised is
elasticsearch.exceptions.RequestError: RequestError(400, 'mapper_parsing_exception', 'Root mapping definition has unsupported parameters: [_default_ : {dynamic=strict, _all={enabled=false}, properties={sha256={type=keyword}, chunksize={type=integer}, chunk={analyzer=ssdeep_analyzer, type=text}, double_chunk={analyzer=ssdeep_analyzer, type=text}, ssdeep={type=keyword}}}] [record : {}]')

Answer 1

A bunch of issues here:
The _all field is deprecated (and has been since v6).
"record": {} is not a valid parameter.
_default_ is deprecated too.
Here's a working mapping:
{
"settings": {
"analysis": {
"analyzer": {
"ssdeep_analyzer": {
"tokenizer": "ssdeep_tokenizer"
}
},
"tokenizer": {
"ssdeep_tokenizer": {
"type": "ngram",
"min_gram": 7,
"max_gram": 7,
"token_chars": [
"letter",
"digit",
"symbol"
]
}
}
}
},
"mappings": {
"dynamic": "strict",
"properties": {
"chunksize": {
"type": "integer"
},
"chunk": {
"analyzer": "ssdeep_analyzer",
"type": "text"
},
"double_chunk": {
"analyzer": "ssdeep_analyzer",
"type": "text"
},
"ssdeep": {
"type": "keyword"
},
"sha256": {
"type": "keyword"
}
}
}
}