Geo-point turns into text after rollover

Elastic Stack Elasticsearch
1

Hi,

During my work with roll-over, I applied a policy in the ILM. This has been used with an index template. I created an index based on that template and it maps to one field type geo-point. I noticed that as soon as a roll-over take place and a new index got created, the new index has the same field as text instead of geo-point.

The following illustrates the problem:

Here is the ILM policy:

      PUT _ilm/policy/some_policy
    {
      "policy": {
        "phases": {
          "hot": {
            "actions": {
              
              "rollover": {
                   
                "max_docs": 1
                
              }
            }
          },
          "delete": {
            "min_age": "1d",
            "actions": {
              "delete": {} 
            }
          }
        }
      }
    }`

The template:

   PUT _template/ssl_template
    {
      "index_patterns": ["test-*"], 
      "settings": {
        "number_of_shards": 1,
        "number_of_replicas": 1,
        "index.lifecycle.name": "some_policy", 
        "index.lifecycle.rollover_alias": "current"
      }
    }

Create an index based on template and map it with a field called location type geo_point

    PUT test-01
    {
      "aliases": {
        "current":{
          "is_write_index": true 
        }
      },
      "mappings" : {
        "properties": {
             "location" : {
                  "type" : "geo_point"
                }
            
          
        } 
        
      }
    }

I put several documents in the index using PUT

   PUT current/_doc/1
      {
        
            "location":"u105z"
          
      }

When I check the mapping of the alias current, I get the following:

      "test-000004" : {
        "mappings" : { }
      },
      "test-000002" : {
        "mappings" : {
          "properties" : {
            "location" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        }
      },
      "test-01" : {
        "mappings" : {
          "properties" : {
            "location" : {
              "type" : "geo_point"
            }
          }
        }
      },
      "test-000003" : {
        "mappings" : {
          "properties" : {
            "location" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        }
      }
    }

As seen in response above, test-01 is the original starting index with field 'location' as 'geo_point', but all the subsequent indices: test-000002, test-000003 have their location field as text.

Your advice is deeply appreciated.

Thanks

2

Hmm, an interesting problem. I can't see anything obviously wrong in your configs. Which version of Elasticsearch are you using?

3

You need to create an index template that applies to all indices matching that pattern. You just applied the mapping to the first index created, which does not carry over to new indices. I would recommend including the mappings you require in the ssl_template.

4

Hi,

My Elasticsearch is version 7.6.0

5

Hi,

So, does that mean to do like that?

PUT test-01
{
  "aliases": {
    "current":{
      "is_write_index": true 
    }
  },
  "mappings" : {
    "properties": {
         "location" : {
              "type" : "geo_point"
            }
        
      
    } 
    
  }
}

and then re-apply the mapping to other indices

PUT test-02
{
  "aliases": {
    "current":{
      "is_write_index": true 
    }
  },
  "mappings" : {
    "properties": {
         "location" : {
              "type" : "geo_point"
            }
        
      
    } 
    
  }
}

PUT test-03
{
  "aliases": {
    "current":{
      "is_write_index": true 
    }
  },
  "mappings" : {
    "properties": {
         "location" : {
              "type" : "geo_point"
            }
        
      
    } 
    
  }
}

??

6

No, you are still applying mapping per index. You should use an index template to apply the correct mappings at index creation.

7

Yes, Thank you very much for the advice. It works now perfectly!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.