# Field type changed results in a conflict - kibana reports an error
**URL:** https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970
**Category:** Kibana
**Created:** [January 11, 2023, 8:57pm UTC](https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970 "2023-01-11T20:57:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mayer](https://discuss.elastic.co/u/mayer)
#### Post date: [January 11, 2023, 8:57pm UTC](https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970/1 "2023-01-11T20:57:42Z")
Dear All,
from a firewall I send log information to filebeat into a self written module. Within a kibana dashboard I have several lenses to get information of different events and aggregations. This is now running several days without any modification, no updates and no reboot. Today I realised that kibana doesn't show some data and brings an error. For example "Field mikrotik\_remoteip is of the wrong type".
Using "Discover" I see an exclamation mark beside several fields, also for "mikrotik\_remoteip". It says "This field is defined as several types ...."
When I visit "Stack Management" -\> "Data Views" -\> "filebeat-\*" I also get the warning with details:
```auto
This field has a type conflict
The type of the mikrotik_remoteip field changes across indices and might not be available for search, visualizations, and other analysis.
Demo of EuiBasicTable
Type Indices
ip .ds-filebeat-8.3.2-2022.12.04-000001, .ds-filebeat-8.5.3-2022.12.11-000001
keyword .ds-filebeat-8.5.3-2023.01.10-000002
```
How is it that the type currently changed from "ip" to "keyword" ?
And what should be done that it doesn't happen again ?
Any help is welcome.
// Hans
---
### Author:  [@jsanz](https://discuss.elastic.co/u/jsanz)
#### Post date: [January 17, 2023, 5:57pm UTC](https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970/2 "2023-01-17T17:57:20Z")
As you may know, Data streams mappings are defined by an index template that may compose (or not) a number of index template components and an Index Lifecycle Policy (ILM) as described here
> **[Set up a data stream | Elasticsearch Guide \[8.6\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-a-data-stream.html)**
Maybe there was a change in your templates or the data stream definition and when a new index was created following the ILM policy, the resulting mapping was different?
You can run queries with Dev Tools to check the templates and definitions or use the Stack Management section just right to the Data Stream tab.
---
### Author:  [@mayer](https://discuss.elastic.co/u/mayer)
#### Post date: [January 24, 2023, 8:51am UTC](https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970/3 "2023-01-24T08:51:09Z")
Hi Jorge, many thanks for this hint and the link. Obviously I did it wrong. As I am using "filebeat" and there is already a index template I have to look how to do and to expand. // Hans
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2023, 8:51am UTC](https://discuss.elastic.co/t/field-type-changed-results-in-a-conflict-kibana-reports-an-error/322970/4 "2023-02-21T08:51:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.