Hi.
An IP field was added into the data, and the ES template was modified.
There's data in ES, but as new set comes in, the template is also made bigger. New field configurations are added into the template.
The IP field has the following configuration:
"ignore_malformed" : true,
"type" : "ip"
Say, today, the field doesn't exist. Hence, the only configuration in the template, say is:
"ignore_malformed": true,
"type": "integer"
The data is ingested with only Number field at the start. Tomorrow, the IP is present in the data, and the IP configuration in the template is added, and the data is indexed. The template is applied before indexing the data.
After indexing for tomorrow, the IP still has the "conflict" word and the yellow exclamation inside yellow triangle shown in the "Index Patterns" in Kibana.
Please share the steps to make sure the data type is applied.
Regards