On Es 2.3.3 cluster (3 node) I have following mapping on a index, please note dynamic mapping for timestamp field (field names ending with _ts)
{
"logs-pc-2016-08-09": {
"mappings": {
"rs": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"integers": {
"mapping": {
"type": "integer"
},
"match_mapping_type": "long"
}
},
{
"ts": {
"mapping": {
"format": "epoch_millis",
"type": "date"
},
"match": "_ts",
"match_mapping_type": "string"
}
},
{
"strings_notanalyzed": {
"mapping": {
"index": "not_analyzed",
"type": "string"
},
"match_mapping_type": "string",
"unmatch": "_analyzed"
}
}
],
"properties": {
...
"orig_timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"pid": {
"type": "string"
},
"product": {
"type": "string"
},
"project_id": {
"type": "string"
},
"server_ts": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"servicename": {
"type": "string"
},
"servicetype": {
"type": "string"
},
"severity": {
"type": "string"
},
"threadid": {
"type": "string"
},
"timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"timezone": {
"type": "string"
},
"upload_ts": {
"type": "date",
"format": "epoch_millis"
},
"uploadxyz_ts": {
"type": "date",
"format": "epoch_millis"
},
"user_id": {
"type": "string"
},
"wfid": {
"type": "string"
}
}
}
}
}
}
Note, uploaded_ts is not part of the already created mapping.
I tried inserting a new doc with uploaded_ts field
POST logs-pc-2016-08-09/rs
{
"server_ts": "1470805090135",
"msgcode": "REP_51025",
"nodename": "N_01861193",
"uploaded_ts": "1470805088738"
}
I get this error
Mixing up field types: class org.elasticsearch.index.mapper.core.DateFieldMapper$DateFieldType != class org.elasticsearch.index.mapper.core.StringFieldMapper$StringFieldType on field
Surprisingly,If I change the uploaded_ts to uploadxyz_ts it works!
Now I have absolutely no clue whats happening.
