Elasticsearch 2.1 _uid is reformated, shard will failed

[whybangbang]

Logstash 2.1: Dynamically Altering Field Names

Hi, I've seen an issue in recent days with sending data to elasticsearch 2.1 where inbound messages contained an "_uid" field which clashed with the type of the in-built meta-field "_uid". This led to indexing failing, shards becoming unassigned and the cluster going into a red state. Given elasticsearch's apparent heightened sensitivity around type handling I feel I need to strip any leading underscores from inbound field names as a safety measure. However, as our log formats vary widely we …

this form maybe met the same problem:
received shard failed for [api-nginx-logs-2016.01.27][0], node[qIW6bRNhRH-f6c4d4mL0_g], [R], v[5], s[STARTED], a[id=LLmaqrfqRTSJeHVoBGGUKg], indexUUID [PkwVMa-pR96vk30tXQZChA], message [failed to update mappings], failure [IllegalArgumentException[Mapper for [_uid] conflicts with existing mapping in other types:
[mapper [_uid] cannot be changed from type [_uid] to [string]]]]
if is a bug in 2.1?

[warkolm (Mark Walkom)]

It's not a bug, it's ES stopping you from having bad mappings.

Can you provide more information, what does the data look like?