How to change the field type ,and there are some question

[24a1128c2f2635cf61df (Tony BigPig)]

i have two fields ,and i want to show them on the Coordinate Map. i remeber someone said that we can't change the field type ,unless changing the index .
those are my two fields ,
"lonlat1" => {
"lat" => "20",
"lon" => "30"
},
"lonlat2" => [
[0] "100",
[1] "10"
],
my index is "pretest*"
yesterday ,they just are struct or array. today,for changing their type to geo_point, i config a template ,and template's name is "pretest*"
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
},
and i haven't change the index name ,

and then i found the lonlat1's type has changed to geo_point, but the lonlat2 is conflict ,and i check the past data ，the lonlat1‘s type is geo_point, and lonlat2 is conflict.
why? why the lonlat1 could change ,but lonlat2 couldn't?
and some one said that if i want to change my field ,i should change change my index ,but i haven't change my index ,the lonlat1'type has been changed to geo_point successfully. who to explain it ?
sorry my english is not good , but the question has puzzled me long time ，thank you！！

[warkolm (Mark Walkom)]

@24a1128c2f2635cf61df

but the lonlat2 is conflict

Where are you seeing this conflict?

[24a1128c2f2635cf61df (Tony BigPig)]

kibana，the managemnet->index patterns

[warkolm (Mark Walkom)]

You will need to reindex that data or delete it to remove that warning. Otherwise just ignore it, it will still work.

[24a1128c2f2635cf61df (Tony BigPig)]

thank you！but why the lonlat1's type was be changed to the GEO_POINT ,but the lonlat2 couldn't?

[warkolm (Mark Walkom)]

You would have to show your template and mapping to be able to comment on that.

[24a1128c2f2635cf61df (Tony BigPig)]

ok！thanks for your reply，and this is my template：
{
"template": "pretest*",
"settings": {
"number_of_shards": "1",
"number_of_replicas": "0"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"_all": {
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
}
}
}
}
}
and the lonlat1's type is struct and lonlat2's type is array:

[warkolm (Mark Walkom)]

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

Also you need to show the actual mapping please, not just a picture of the data.

[24a1128c2f2635cf61df (Tony BigPig)]

ok!
the template:
{
"template": "pretest*",
"settings": {
"number_of_shards": "1",
"number_of_replicas": "0"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"_all": {
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
}
}
}
}
}

and my logstash.conf:

input {
kafka{
bootstrap_servers => "127.0.0.1:19092,127.0.0.1:19093"
topics => ["summer"]
codec => "json"
ssl => true
}
}

filter {
if[type] == "latandlon_data"{
grok{
match => {"message" => "%{DATA:lat},%{DATA:long}"}
add_field => [ "[lonlat1][lat]", "%{[lat]}" ]
add_field => [ "[lonlat1][lon]", "%{[long]}" ]
add_field => ["[lonlat2]", "%{[long]}"]
add_field => ["[lonlat2]", "%{[lat]}"]
}
}

}

output {
if[type] =="latandlon_data" {
elasticsearch {
hosts => "127.0.0.1:9200"
manage_template => true
template_overwrite => true
template =>"/usr/local/elk/logstash-5.6.2/templates/mytemplate2.json"
template_name => "pretest"
index => "pretest-common-latandlon_log-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
}

thanks!!