title: How to update Mapping
body: <p>How can I update index mapping to include the following field <code>doc_as_upsert : true</code></p>
  
  <p>My logstash ingesting cloudtrail logs from s3 is showing the following on the log
  <code>
  Could not index event to Elasticsearch. {:status=&gt;400, :action=&gt;["index", {:_id=&gt;nil, :_index=&gt;"cloudtrail-2018.10.08", :_type=&gt;"doc", :_routing=&gt;nil}, #&lt;LogStash::Event:0x251f932&gt;], :response=&gt;{"index"=&gt;{"_index"=&gt;"cloudtrail-2018.10.08", "_type"=&gt;"doc", "_id"=&gt;"t2mmVWYBVQr-RbWuAQIS", "status"=&gt;400, "error"=&gt;{"type"=&gt;"mapper_parsing_exception", "reason"=&gt;"failed to parse [requestParameters.disableApiTermination]", "caused_by"=&gt;{"type"=&gt;"json_parse_exception", "reason"=&gt;"Current token (START_OBJECT) not of boolean type\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@133a6c; line: 1, column: 1509]"}}}}}
  </code></p>
  
  <p>Mapping is dynamic and very long so can't fit it all here but here is what I cat fit</p>
  
  <pre><code>{
    "cloudtrail-2018.10.08": {
      "mappings": {
        "_default_": {
          "dynamic_templates": [
            {
              "message_field": {
                "path_match": "message",
                "match_mapping_type": "string",
                "mapping": {
                  "norms": false,
                  "type": "text"
                }
              }
            },
            {
              "string_fields": {
                "match": "*",
                "match_mapping_type": "string",
                "mapping": {
                  "fields": {
                    "keyword": {
                      "ignore_above": 256,
                      "type": "keyword"
                    }
                  },
                  "norms": false,
                  "type": "text"
                }
              }
            }
          ],
          "properties": {
            "@timestamp": {
              "type": "date"
            },
            "@version": {
              "type": "keyword"
            },
            "geoip": {
              "dynamic": "true",
              "properties": {
                "ip": {
                  "type": "ip"
                },
                "latitude": {
                  "type": "half_float"
                },
                "location": {
                  "type": "geo_point"
                },
                "longitude": {
                  "type": "half_float"
                }
              }
            }
          }
        },
        "doc": {
          "dynamic_templates": [
            {
              "message_field": {
                "path_match": "message",
                "match_mapping_type": "string",
                "mapping": {
                  "norms": false,
                  "type": "text"
                }
              }
            },
            {
              "string_fields": {
                "match": "*",
                "match_mapping_type": "string",
                "mapping": {
                  "fields": {
                    "keyword": {
                      "ignore_above": 256,
                      "type": "keyword"
                    }
                  },
                  "norms": false,
                  "type": "text"
                }
              }
            }
          ],
          "properties": {
            "@timestamp": {
              "type": "date"
            },
            "@version": {
              "type": "keyword"
            },
            "additionalEventData": {
              "properties": {
                "configRuleArn": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "configRuleInputParameters": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "configRuleName": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "managedRuleIdentifier": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "notificationJobType": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "vpcEndpointId": {
                  "type": "text",
                  "norms": false,
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                }
              }
            },
            "apiVersion": {
              "type": "date"
            },
            "awsRegion": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "errorCode": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "errorMessage": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "eventID": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "eventName": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "eventSource": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "eventType": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "eventVersion": {
              "type": "text",
              "norms": false,
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            }
  </code></pre>
  
  <p>Here am get the following errors when I try update the mapping with these</p>
  
  <pre><code>PUT cloudtrail-*/_mapping/_doc
  {
    "properties": {
      "doc_as_upsert": true
      }
    }
  </code></pre>
  
  <p>I get error </p>
  
  <pre><code>{
    "error": {
      "root_cause": [
        {
          "type": "mapper_parsing_exception",
          "reason": "Expected map for property [fields] on field [doc_as_upsert] but got a class java.lang.String"
        }
      ],
      "type": "mapper_parsing_exception",
      "reason": "Expected map for property [fields] on field [doc_as_upsert] but got a class java.lang.String"
    },
    "status": 400
  }
  </code></pre>