How to change the field type ,and there are some question

Elastic Stack Elasticsearch
1

i have two fields ,and i want to show them on the Coordinate Map. i remeber someone said that we can't change the field type ,unless changing the index .
those are my two fields ,
"lonlat1" => {
"lat" => "20",
"lon" => "30"
},
"lonlat2" => [
[0] "100",
[1] "10"
],
my index is "pretest*"
yesterday ,they just are struct or array. today,for changing their type to geo_point, i config a template ,and template's name is "pretest*"
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
},
and i haven't change the index name ,

and then i found the lonlat1's type has changed to geo_point, but the lonlat2 is conflict ,and i check the past data ，the lonlat1‘s type is geo_point, and lonlat2 is conflict.
why? why the lonlat1 could change ,but lonlat2 couldn't?
and some one said that if i want to change my field ,i should change change my index ,but i haven't change my index ,the lonlat1'type has been changed to geo_point successfully. who to explain it ?
sorry my english is not good , but the question has puzzled me long time ，thank you！！

2

Where are you seeing this conflict?

4

kibana，the managemnet->index patterns

WX20171130-114113@2x
WX20171130-114113@2x.png1216×212 7.86 KB

5

You will need to reindex that data or delete it to remove that warning. Otherwise just ignore it, it will still work.

7

thank you！but why the lonlat1's type was be changed to the GEO_POINT ,but the lonlat2 couldn't?

8

You would have to show your template and mapping to be able to comment on that.

9

ok！thanks for your reply，and this is my template：
{
"template": "pretest*",
"settings": {
"number_of_shards": "1",
"number_of_replicas": "0"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"_all": {
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
}
}
}
}
}
and the lonlat1's type is struct and lonlat2's type is array:
image

10

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

Also you need to show the actual mapping please, not just a picture of the data.

11

ok!
the template:
{
"template": "pretest*",
"settings": {
"number_of_shards": "1",
"number_of_replicas": "0"
},
"mappings": {
"default": {
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"_all": {
"enabled": true
},
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"lonlat1": {
"type": "geo_point"
},
"lonlat2": {
"type": "geo_point"
}
}
}
}
}

and my logstash.conf:

input {
kafka{
bootstrap_servers => "127.0.0.1:19092,127.0.0.1:19093"
topics => ["summer"]
codec => "json"
ssl => true
}
}

filter {
if[type] == "latandlon_data"{
grok{
match => {"message" => "%{DATA:lat},%{DATA:long}"}
add_field => [ "[lonlat1][lat]", "%{[lat]}" ]
add_field => [ "[lonlat1][lon]", "%{[long]}" ]
add_field => ["[lonlat2]", "%{[long]}"]
add_field => ["[lonlat2]", "%{[lat]}"]
}
}

}

output {
if[type] =="latandlon_data" {
elasticsearch {
hosts => "127.0.0.1:9200"
manage_template => true
template_overwrite => true
template =>"/usr/local/elk/logstash-5.6.2/templates/mytemplate2.json"
template_name => "pretest"
index => "pretest-common-latandlon_log-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
}

thanks!!

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.