# Creating a seperate index for conflicting logs

**URL:** <https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 8, 2024, 12:14am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563 "2024-08-08T00:14:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![calbertan](https://avatars.discourse-cdn.com/v4/letter/c/54ee81/32.png) [@calbertan](https://discuss.elastic.co/u/calbertan)\
**Post date:** [August 8, 2024, 12:14am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/1 "2024-08-08T00:14:12Z")

</div>

log a has field "ts" of type float  
log b has field "ts" of type date  
This is causing a WARN - cannot create index

Ideally, I don't want to have to drop one of the logs, so I wanted to create a index specifically for log b which is only coming from a certain pod. This are the indeces I have made

```auto
- index: "index-a-%{+yyyyMM}" 
  when.not.regexp:
      kubernetes.pod.name: "mypod-.*"
  when.regexp:
     kubernetes.namespace: "mynamespace-*"

- index: "index-b-%{+yyyyMM}" 
   when.regexp:
      kubernetes.pod.name: "mypod-.*"
      kubernetes.namespace: "mynamespace-.*"

```

With the above config, I am still getting the WARN, and index-b is not created. Any help would be greatly appreciated

---

<div class="post-metadata">

**Author:** ![calbertan](https://avatars.discourse-cdn.com/v4/letter/c/54ee81/32.png) [@calbertan](https://discuss.elastic.co/u/calbertan)\
**Post date:** [August 8, 2024, 12:15am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/2 "2024-08-08T00:15:08Z")

</div>

Category updated on August 8, 2024, 12:15am UTC

From #Beats to #Elasticsearch

---

<div class="post-metadata">

**Author:** ![calbertan](https://avatars.discourse-cdn.com/v4/letter/c/54ee81/32.png) [@calbertan](https://discuss.elastic.co/u/calbertan)\
**Post date:** [August 8, 2024, 12:15am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/3 "2024-08-08T00:15:08Z")

</div>

Tags updated on August 8, 2024, 12:15am UTC

Removed #filebeat

---

<div class="post-metadata">

**Author:** ![calbertan](https://avatars.discourse-cdn.com/v4/letter/c/54ee81/32.png) [@calbertan](https://discuss.elastic.co/u/calbertan)\
**Post date:** [August 8, 2024, 12:16am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/4 "2024-08-08T00:16:28Z")

</div>

Category updated on August 8, 2024, 12:16am UTC

From #Elasticsearch to #Beats

---

<div class="post-metadata">

**Author:** ![calbertan](https://avatars.discourse-cdn.com/v4/letter/c/54ee81/32.png) [@calbertan](https://discuss.elastic.co/u/calbertan)\
**Post date:** [August 8, 2024, 12:16am UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/5 "2024-08-08T00:16:29Z")

</div>

Tags updated on August 8, 2024, 12:16am UTC

Added #filebeat

---

<div class="post-metadata">

**Author:** ![OneWhoKnowsNothing](https://avatars.discourse-cdn.com/v4/letter/o/7c8e57/32.png) [@OneWhoKnowsNothing](https://discuss.elastic.co/u/OneWhoKnowsNothing)\
**Post date:** [August 9, 2024, 5:44pm UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/6 "2024-08-09T17:44:53Z")

</div>

if you are ok with using same index just moving the conflicting field.  
you can use the [rename](https://www.elastic.co/guide/en/beats/winlogbeat/current/rename-fields.html) processor.  
you can tell it to move the field\_x to field\_a if condition A was met

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [August 12, 2024, 1:01pm UTC](https://discuss.elastic.co/t/creating-a-seperate-index-for-conflicting-logs/364563/7 "2024-08-12T13:01:01Z")

</div>

Hi @calbertan Welcome to the Elastic community.

There might be multiple cases -

1. Before re ingesting you need to delete old index so that it will create a new with specific field type. Make sure a and b log going in dedicated index.
2. After getting error just check the mapping of an index. Usually this happen if you trying to ingest multi type of data on single field.

Some solutions -

1. Maintain 2 `ts` field with different [type](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-fields.html).
2. You can even try [object field](https://www.elastic.co/guide/en/elasticsearch/reference/current/object.html) to maintain both data.