How to update date field type to a string in ES?

Hi ES team,
I am trying to build a custom ES template where one field would occasionally passes a string that matches with date format causing mapping conflicts and dropping of data by logstash. If i try to disable auto date detection for a field in advanced settings, the index is coming up fine but i couldn't search based on time in kibana as ES is treating timestamp field as a string.
I would want something with auto date detection on and one field to be a string no matter what type of data is passed through it. Can you please let me know of potential solutions for this?


This is usually what a template would handle for you.

Perhaps if you shared the one that you have we can help.

I am using default template with auto date detection off. Are you saying that i need to add that particular field and explicitly mention to treat it as a string? if i do that, would the advanced settings override the earlier declared mapping?

Yes, you need to define your own template for the index.

It'd only apply for new indices created.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.