Elastic mapping Issue

Elastic Stack Elasticsearch
1

I am using ELK version 8.12.0. I have a field called

'request.querystring.username'

and that field has different data types keyword and boolean in different indices.

  • Why the same field has the same different data types in different indices?
  • How to list the indices which contains the boolean data type for that field?
  • How to fix the data type as keyword for the same field in the future?
2

Hello

  1. This could be an index mapping problem, try GET <index_name>/mapping for each index to check how the fields are being mapped to
  2. reindex and into a new index and change the alias name to the old index name
  3. You can have a look into dynamic mapping or setting up an index template so that field will be mapped as a keyword in future data ingestions
3 
GET index_name/_mapping

or

GET index_name/_mapping/field/request

either create component template or just recreate the index template
again set the mapping for that particular object request

"request": {
    "properties":{
         "querystring": {
             "properties": {
                  "username" : {
                      "type":"keyword" 
                  }
             }
          }
     }
}

and reindex the data after completely deleting the existing index

4

From Elastic Search to Elasticsearch

5

Hi @kishorkumar I have a template named kong-index-template
How to update this template with the required mappings, please?

6

get all the information of index that you are using and to update follow the documentation

and then follow the documentation : [(Index templates | Elasticsearch Guide [8.15] | Elastic]((Index templates | Elasticsearch Guide [8.15] | Elastic)

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.