Dynamic mapping is changing existing fields format and type

Elastic Stack Elasticsearch
1

Hello Team,

We are using Elasticsearch - 2.3.5 for feeding the Amazon Cloudtrail data. We have created mapping for a index and for certain fields their type will changes automatically. We want certain fields to use particular date format.

By default dynamic mapping is enabled. So we have scenarios where new fields can be added so we need dynamic mapping.

Eg:
"apiVersion": {
"type": "string"
}

automatically changed to

"apiVersion": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},

We would like to know why ES is changing format and type of a field. How we can avoid this scenario.

2

You can not change existing mappings for fields in Elasticsearch, but mappings can be identified differently for new indices when using dynamic mappings, depending on what the data in the first encountered field look like. You can control this using index templates.

3

We are not trying to update the existing index. We were trying to create new index with a mapping but it will change once the data is fed to that index. We need to avoid this

4

In order to guarantee consistent mappings across indices you can use index templates or possibly drive the mapping based on naming conventions for fields.