How to update date field type to a string in ES?

[srk1 (sankeerth)]

Hi ES team,
I am trying to build a custom ES template where one field would occasionally passes a string that matches with date format causing mapping conflicts and dropping of data by logstash. If i try to disable auto date detection for a field in advanced settings, the index is coming up fine but i couldn't search based on time in kibana as ES is treating timestamp field as a string.
I would want something with auto date detection on and one field to be a string no matter what type of data is passed through it. Can you please let me know of potential solutions for this?

Thanks,
SRK.

[warkolm (Mark Walkom)]

This is usually what a template would handle for you.

Perhaps if you shared the one that you have we can help.

[srk1 (sankeerth)]

I am using default template with auto date detection off. Are you saying that i need to add that particular field and explicitly mention to treat it as a string? if i do that, would the advanced settings override the earlier declared mapping?

[warkolm (Mark Walkom)]

@srk1

Are you saying that i need to add that particular field and explicitly mention to treat it as a string

Yes, you need to define your own template for the index.

@srk1

if i do that, would the advanced settings override the earlier declared mapping?

It'd only apply for new indices created.