@Opster_support could it be that some of the "dynamic" fields for index templates have a value set to "true"
and some to true
(notice no quotations marks) meaning that some of them are stored as Booleans
and some as strings
?
The specific index template that I am trying to retrieve has it stored as a Boolean true
:
{
"index_templates": [
{
"name": "debug-1.0.0",
"index_template": {
"index_patterns": [
"beat-debug-1.0.0*"
],
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "debugbeat",
"rollover_alias": "beat-debug-1.0.0"
},
"number_of_shards": "1",
"priority": "100",
"number_of_replicas": "1"
}
},
"mappings": {
"_routing": {
"required": false
},
"numeric_detection": false,
"dynamic_date_formats": [
"strict_date_optional_time",
"yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
],
"_source": {
"excludes": [],
"includes": [],
"enabled": true
},
"dynamic": true,
"dynamic_templates": [],
"date_detection": true,
"properties": {
"computer": {
"type": "object",
"properties": {
"name": {
"type": "keyword"
}
}
},
"@timestamp": {
"type": "date"
},
"file": {
"type": "object",
"properties": {
"path": {
"type": "keyword"
},
"name": {
"type": "keyword"
},
"size(mb)": {
"coerce": true,
"ignore_malformed": true,
"type": "double"
}
}
},
"software": {
"type": "object",
"properties": {
"version": {
"type": "keyword"
}
}
},
"action": {
"type": "object",
"properties": {
"duration": {
"coerce": true,
"ignore_malformed": true,
"type": "double"
},
"name": {
"type": "keyword"
}
}
},
"message": {
"type": "text"
},
"user": {
"type": "object",
"properties": {
"name": {
"type": "keyword"
}
}
}
}
}
},
"composed_of": [
"logs-mappings"
],
"version": 1
}
}
]
}
Is there a way to handle both cases ie. coerce the value from boolean true
to string "true"
or vice versa?