DataType Changes after rollover of Index

Elastic Stack Elasticsearch
1

Hi Team

I am using Elasticsearch Version 7.5.2.
I have one index with grows in size and documents. Once it has reached 1000 documents , we are performing rollover.

Command :
curl -XPOST '10.10.10.1:9200/myevents/_rollover?pretty' -H 'Content-Type: application/json' -d '{ "conditions": { "max_docs": 1000}}'

Index is having mapping with one field "starttime" having data type "date".

But after rollover new index is having data type as "long" for same field.

Does rollover changes mapping data type of original index ?

I am aware of specifying mapping in rollover command , would like to understand the rollover behaviour in here.

Can you please help me in understanding..

Thanks
Tushar Nemade

1 Like
2

What does your index template(s) look like?

3

We do not use Index template..

4

If you do not use index template the type will be automatically mapped based on the first document encountered and can vary. I would recommend using an index template to control mappings for important fields.

5

Okay.

So can we state below this is what would have happened.

  1. Rollover condition met , Index is rollover to myevents-000002
  2. After Rollover the first document came in, having field "startTime" was some value "epoch" , hence it made it as long data type. While the existing "myevents-000001" was having data type as "date".
6

Yes, epoch timestamps are not recognized as dates when dynamic mapping is used.

1 Like
7

Got it.

Thank You Christian , for your time and responses to the point. It help me in my understanding.

  1. Rollover does not maintain mapping of existing index
  2. EPOCH is not always "DATE" data type considered in mapping dynamically.

Thank You
Tushar Nemade

8

No, this is exactly what index templates are for.

Epoch is NEVER dynamically mapped as a date as it does not pass date detection.

9

Thank You very much...

10

If you look in the docs it includes creating an index template in the steps described.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.