How to update date field type to a string in ES?

Elastic Stack Elasticsearch
1

Hi ES team,
I am trying to build a custom ES template where one field would occasionally passes a string that matches with date format causing mapping conflicts and dropping of data by logstash. If i try to disable auto date detection for a field in advanced settings, the index is coming up fine but i couldn't search based on time in kibana as ES is treating timestamp field as a string.
I would want something with auto date detection on and one field to be a string no matter what type of data is passed through it. Can you please let me know of potential solutions for this?

Thanks,
SRK.

2

This is usually what a template would handle for you.

Perhaps if you shared the one that you have we can help.

3

I am using default template with auto date detection off. Are you saying that i need to add that particular field and explicitly mention to treat it as a string? if i do that, would the advanced settings override the earlier declared mapping?

4

Yes, you need to define your own template for the index.

It'd only apply for new indices created.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.