We have a template setup with static mappings that are applied to a daily index, the index is only created when a document is stored in that index. We have a stream of data that's always being stored, so when a piece of data comes in that belongs to a new day, that index is automatically created and the template applied via the index patterns, and it also creates an alias that groups all the daily index under one alias.
The problem that we're seeing is that the first few documents that are stored in that index have a strange date format, but after that the rest are fine. When I say strange it's not really a strange format, but they are supposed to be stored as epoch, except on these occasions where the first few documents get stored as a string in "2019-07-06T00:02:18.000+0000" format.
My question is, is there an order to the index creation where one document can come in, trigger an index creation, right after that another document comes in to be saved to the same index and is saved before the template mappings are somehow applied?
I'm gathering that we probably need to create the index before the data starts flowing in to try to control that, but I was just curious if anyone knew anything about this because I haven't found anything in my search.