title: How to stop logstash from creating a default mapping in ElasticSearch
body: <p>I am using logstash to feed logs into ElasticSearch.
  I am configuring logstash output as:</p>
  
  <pre><code>input {
  file {
              path =&gt; "/tmp/foo.log"
              codec =&gt;
                      plain {
                      format =&gt; "%{message}"
              }
      }
  }
  output {
          elasticsearch {
                          #host =&gt; localhost 
                          codec =&gt; json {}
                          manage_template =&gt; false
                          index =&gt; "4glogs"
                  }
  }
  </code></pre>
  
  <p>I notice that as soon as I start logstash it creates a mapping ( logs ) in ES as below.</p>
  
  <pre><code>{
      "4glogs": {
          "mappings": {
              "logs": {
                  "properties": {
                      "@timestamp": {
                          "type": "date",
                          "format": "dateOptionalTime"
                      },
                      "@version": {
                          "type": "string"
                      },
                      "message": {
                          "type": "string"
                      }
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>How can I prevent logstash from creating this mapping ?</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I have now resolved this error too. <strong>"object mapping for [logs] tried to parse as object, but got EOF, has a concrete value been provided to it?"</strong></p>
  
  <p>As John Petrone has stated below, once you define a mapping, you have to ensure that your documents conform to the mapping. In my case, I had defined a mapping of "type: nested" but the output from logstash was a string. 
  So I removed all codecs ( whether json or plain ) from my logstash config and that allowed the json document to pass through without changes.</p>
  
  <p>Here is my new logstash config ( with some additional filters for multiline logs ).</p>
  
  <pre><code>input {
      kafka {
          zk_connect =&gt; "localhost:2181"
          group_id =&gt; "logstash_group"
          topic_id =&gt; "platform-logger"
          reset_beginning =&gt; false
          consumer_threads =&gt; 1
          queue_size =&gt; 2000
          consumer_id =&gt; "logstash-1"
          fetch_message_max_bytes =&gt; 1048576
          }
          file {
                  path =&gt; "/tmp/foo.log"
          }
  }
  filter {
    multiline {
      pattern =&gt; "^\s"
      what =&gt; "previous"
    }
    multiline {
      pattern =&gt; "[0-9]+$"
      what =&gt; "previous"
    }
    multiline {
      pattern =&gt; "^$"
      what =&gt; "previous"
    }
          mutate{
                  remove_field =&gt; ["kafka"]
                  remove_field =&gt; ["@version"]
                  remove_field =&gt; ["@timestamp"]
                  remove_tag =&gt; ["multiline"]
          }
   }
  output {
          elasticsearch {
                          manage_template =&gt; false
                          index =&gt; "4glogs"
                  }
  }
  </code></pre>