# Buggy code
def WriteHeader(self):
    """Connects to the Elasticsearch server and creates the index."""
    mappings = {}

    if self._raw_fields:
        if self._document_type not in mappings:
            mappings[self._document_type] = {}

        mappings[self._document_type]["dynamic_templates"] = [
            {
                "strings": {
                    "match_mapping_type": "string",
                    "mapping": {
                        "fields": {
                            "raw": {
                                "type": "keyword",
                                "index": "false",
                                "ignore_above": self._ELASTIC_ANALYZER_STRING_LIMIT,
                            }
                        }
                    },
                }
            }
        ]

    self._Connect()

    self._CreateIndexIfNotExists(self._index_name, mappings)


# Traceback (elasticsearch.exceptions.RequestError)
Traceback (most recent call last):
File "/usr/bin/psteal.py", line 110, in <module>
if not Main():
File "/usr/bin/psteal.py", line 87, in Main
tool.AnalyzeEvents()
File "/usr/lib/python3/dist-packages/plaso/cli/psteal_tool.py", line 218, in AnalyzeEvents
analysis_engine.ExportEvents(
File "/usr/lib/python3/dist-packages/plaso/multi_processing/psort.py", line 997, in ExportEvents
output_module.WriteHeader()
File "/usr/lib/python3/dist-packages/plaso/output/elastic.py", line 72, in WriteHeader
self._CreateIndexIfNotExists(self._index_name, mappings)
File "/usr/lib/python3/dist-packages/plaso/output/shared_elastic.py", line 98, in _CreateIndexIfNotExists
self._client.indices.create(
File "/usr/lib/python3/dist-packages/elasticsearch/client/utils.py", line 92, in _wrapped
return func(*args, params=params, headers=headers, **kwargs)
File "/usr/lib/python3/dist-packages/elasticsearch/client/indices.py", line 103, in create
return self.transport.perform_request(
File "/usr/lib/python3/dist-packages/elasticsearch/transport.py", line 355, in perform_request
status, headers_response, data = connection.perform_request(
File "/usr/lib/python3/dist-packages/elasticsearch/connection/http_urllib3.py", line 248, in perform_request
self._raise_error(response.status, raw_data)
File "/usr/lib/python3/dist-packages/elasticsearch/connection/base.py", line 243, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
elasticsearch.exceptions.RequestError: RequestError(400, 'mapper_parsing_exception', 'Root mapping definition has unsupported parameters:  [plaso_event : {dynamic_templates=[{strings={mapping={fields={raw={ignore_above=10922, index=false, type=keyword}}}, match_mapping_type=string}}]}]')

# Fixed code
def WriteHeader(self):
    """Connects to the Elasticsearch server and creates the index."""
    mappings = {}

    if self._raw_fields:
        # This cannot be static because we use the value of self._document_type
        # from arguments.
        mappings = {
            "dynamic_templates": [
                {
                    "strings": {
                        "mapping": {
                            "fields": {
                                "raw": {
                                    "ignore_above": (
                                        self._ELASTIC_ANALYZER_STRING_LIMIT
                                    ),
                                    "index": "false",
                                    "type": "keyword",
                                },
                            },
                        },
                        "match_mapping_type": "string",
                    },
                }
            ],
        }

        # TODO: Remove once Elasticsearch v6.x is deprecated.
        if self._GetClientMajorVersion() < 7:
            mappings = {self._document_type: mappings}

    self._Connect()

    self._CreateIndexIfNotExists(self._index_name, mappings)