ES 5.1.2 dynamic mapping different in 2 identical environments

[dougbergh]

I have two environments, both running Elastic Search v. 5.1.2. I have no default mapping templates.

ES is creating a different mapping for the same field, in the two environments, as below. I could create a template, but I would rather not because it's work...anyone know why this might occur?

It's logstash, and I've looked at the first entries in the index (using kibana), and they appear identical to me.

env1:
"user_uuid": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword"
}
}
},

env2:
"user_uuid": {
"type": "text",
"norms": false,
"fields": {
"raw": {
"type": "keyword",
"ignore_above": 256
}
}
},

Note the type in env1 is "raw", that in env2 is "keyword". I expect "keyword", based on this article: https://www.elastic.co/blog/strings-are-dead-long-live-strings.

The es versions are:
env1:
"version" : {
"number" : "5.1.2",
"build_hash" : "c8c4c16",
"build_date" : "2017-01-11T20:18:39.146Z",
"build_snapshot" : false,
"lucene_version" : "6.3.0"
},

env2:
"version" : {
"number" : "5.1.2",
"build_hash" : "c8c4c16",
"build_date" : "2017-01-11T20:18:39.146Z",
"build_snapshot" : false,
"lucene_version" : "6.3.0"
},

[warkolm (Mark Walkom)]

@dougbergh

Note the type in env1 is "raw", that in env2 is "keyword"

There's 2 fields here.

user_uuid, user_uuid.raw in env1 and user_uuid in env2.

The .raw usually won't be created by default though, it's something you need to specify. Are you sure there is no template for it?

[dougbergh]

Thanks for the reply! It's helpful!
I'm not sure what you mean, though. I think there is one field in each env; in env1 it's called 'keyword' and in env2 it's called 'raw'. Each if of type 'keyword'.
I'm pretty sure there's no template, but I'm not 100%. I'll check that..
BTW I couldn't figure out how to show the mappings with indentations - that would make it clearer. Do you know how?

[dougbergh]

@warkolm, you were right! There are dynamic templates and they're different! I thought 'string' type ceased to exist in 5.0; the templates may have been created when we were running on 2.x. Thanks again!!

env1:
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],

env2:
"dynamic_templates": [
{
"message_field": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"fielddata": {
"format": "disabled"
},
"index": "analyzed",
"omit_norms": true,
"type": "string"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fielddata": {
"format": "disabled"
},
"fields": {
"raw": {
"ignore_above": 256,
"index": "not_analyzed",
"type": "string"
}
},
"index": "analyzed",
"omit_norms": true,
"type": "string"
}
}
}
],

[dougbergh]

...so it turns out we didn't create those templates, es did...so i've asked a different question: es 5.1.2 creating dynamic_template with raw...