Excerpt from template:
(Ruby hash)
index_patterns: [
"ldb-dvm-*",
],
order: 200,
...
...
aliases: {
'ldb-dvm' => {},
},
mappings: {
_source: {
enabled: true,
},
dynamic_templates: [{
strings: {
match: '*',
match_mapping_type: 'string',
mapping: {
type: 'text', fields: { raw: { type: 'keyword', ignore_above: 256 } },
},
},
},],
properties: {
'@timestamp' => { type: 'date', doc_values: true },
'@version' => { type: 'keyword' },
:environment => { type: 'text', fielddata: true },
:application => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
:host => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
:host_ip => { type: 'ip', doc_values: true, null_value: '127.0.0.1' },
:type => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
:type_group => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
...
...
This template is created via REST API BEFORE any such index is created.
And after that this appears in the elasticsearch log (excerpt):
[ldb-dvm-system-2020.10.08] creating index, cause [auto(bulk api)], templates [ldb-dvm-environment], shards [1]/[0]
Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[ldb-dvm-system-2020.10.08][0]]]).
[ldb-dvm-system-2020.10.08/HndQQ8J9TrGfTNyy_USBNA] update_mapping [_doc]
[ldb-dvm-system-2020.10.08] [[ldb-dvm-system-2020.10.08/HndQQ8J9TrGfTNyy_USBNA]] failed to apply mappings
java.lang.IllegalArgumentException: Mapper for [host_ip] conflicts with existing mapping:
[mapper [host_ip] has different [null_value] values]
at org.elasticsearch.index.mapper.FieldMapper.merge(FieldMapper.java:308) ~[elasticsearch-7.9.0.jar:7.9.0]
...
...
So it says the index was autocreated based on the ldb-dvm-environment template which is the one above, right?
When I checked the mapping of the index template, the null_value was set in its mapping.
If I remove the null_value from the template, the error does not appear.
Now how do I force ELK to use the mappings from the template during index creation?