7.9: "....creating index, cause [auto(bulk api)],..." ignores null_values set in legacy index template

Excerpt from template:
(Ruby hash)

index_patterns: [
  "ldb-dvm-*",
],
order: 200,
...
...
aliases:  {
  'ldb-dvm' => {},
},
mappings: {
  _source:           {
    enabled: true,
  },
  dynamic_templates: [{
    strings: {
      match:              '*',
      match_mapping_type: 'string',
      mapping:            {
        type: 'text', fields: { raw: { type: 'keyword', ignore_above: 256 } },
      },
    },
  },],
  properties:        {
    '@timestamp'      => { type: 'date',   doc_values: true },
    '@version'        => { type: 'keyword' },
    :environment      => { type: 'text',   fielddata: true },
    :application      => { type: 'text',   fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
    :host             => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
    :host_ip          => { type: 'ip', doc_values: true, null_value: '127.0.0.1' },
    :type             => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
    :type_group       => { type: 'text', fields: { keyword: { type: 'keyword', ignore_above: 256 } } },
    ...
    ...

This template is created via REST API BEFORE any such index is created.
And after that this appears in the elasticsearch log (excerpt):

[ldb-dvm-system-2020.10.08] creating index, cause [auto(bulk api)], templates [ldb-dvm-environment], shards [1]/[0]
Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[ldb-dvm-system-2020.10.08][0]]]).
[ldb-dvm-system-2020.10.08/HndQQ8J9TrGfTNyy_USBNA] update_mapping [_doc]
[ldb-dvm-system-2020.10.08] [[ldb-dvm-system-2020.10.08/HndQQ8J9TrGfTNyy_USBNA]] failed to apply mappings
java.lang.IllegalArgumentException: Mapper for [host_ip] conflicts with existing mapping:
[mapper [host_ip] has different [null_value] values]
        at org.elasticsearch.index.mapper.FieldMapper.merge(FieldMapper.java:308) ~[elasticsearch-7.9.0.jar:7.9.0]
...
...

So it says the index was autocreated based on the ldb-dvm-environment template which is the one above, right?
When I checked the mapping of the index template, the null_value was set in its mapping.

If I remove the null_value from the template, the error does not appear.

Now how do I force ELK to use the mappings from the template during index creation?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.