Conflict occur with rollup job

[Nitin08bisht (Nitin)]

Hi Team,

I am using elasticsearch and kibana 7.16.2 and I'm facing conflicts on index pattern while creating process wise Visualization dashboard.

Below I have describe two scenario, In which I faced conflict on scenario 2.

scenario 1.
In this scenario, I have created single visualization dashboard for all process. Also I have taken snapshot and restore it. And started rollup job which create rollup index. And In this scenario no conflicts occur and also data appear on visualization dashboard.

Scenario 2.
In this scenario, I have created process wise separate visualization dashboard for every process. Also I have taken snapshot and restore it. And start rollup job which create rollup index. But, In this scenario conflicts occur on that fields which I have taken while creating rollup job.
Which causing data not visualize on visualization dashboard.
**

**

Please suggest me what I have to do remove that conflicts.

Thanks,
Nitin Bisht

[Nitin08bisht (Nitin)]

Hi Team,

The conflict arises on the index pattern field that I have taken for the rollup index while creating the rollup job. Due to which I am not able to visualize the data on process wise visualization dashboard. It is showing error on process wise visualization dashboard instead of showing data. Please help me.

Thanks,
Nitin Bisht

[nickpeihl]

Hi Nitin. One of the indexes that matches your index pattern has fields mappings that do not match other indexes. Kibana expects all indexes matching an index pattern to have matching field mappings. Perhaps you can change the index pattern to only match the index where the fields are not mapped as object?

[Nitin08bisht (Nitin)]

Hi @nickpeihl, it is not clear for me. Can you explain it more.

[nickpeihl]

Hi Nitin. Your index pattern uses * to match against indexes in Elasticsearch. In most cases, the index pattern will use some specificity in front of * like logs-* to only match indexes that start with logs- (e.g. logs-2022-12-08, logs-2022-12-09, etc). Your index pattern will match every index in Elasticsearch. Some of those indexes have fields that have the same field name, but not the same field data types.

I suspect at least one of your Elasticsearch indexes does not have the correct field data types as @timestamp is usually mapped as date not object. I think you should check the mapping for each index and delete or reindex those indexes that have incorrect mappings.