How to restrict timestamp field in multi layer JSON where field with same name but different data types are present in second layer of JSON

Elastic Stack Elasticsearch
1

In my dynamic template I am adding field with name "timestamp" as of date type. It is later converted to epoch. now in a particular case there is one more field with name "timestamp" in second layer of multi layer JSON, for which epoch conversion is failing.
I want to restrict Elasticsearch to consider the "timestamp" field in only at layer 1 of JSON.

IS there any configuration by which I can achieve this?

My Sample JSON:

{

"transactionId":"gdfgkldgn-543vdk345j-dfgkndg",
"timestamp":"2018-11-16T17:01:29.535Z",
"eventName":"testing",
"userId":"utest@test.com",
"before":{
"userName":" test@test.address ",
"lastChanged":{
"date":"2018-11-16T17:01:10.249Z"
},
"lastSync":{
"TestingUser_Manager":{
"timestamp":"2018-09-30T01:41:09.005-04:00"
}
}
}
}
In the above JSON the inner timestamp value is failing to convert to epoch.

Dynamic template: below mention as timestamp field in Dynamic Template.

"timestamp_data_template":{
"match":"timestamp",
"mapping":{
"type":"long",
"store":"yes"
}
}

2

Is there any configuration to limit where to look for timestamp field in JSON before sending it to elastic search.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.