IP address mapping conflict

[marky]

Hi,

I tried searching for a solution to this but I wasn't able to get very far. I'm importing numerous JSON documents that contain various logs (AWS cloudtrail logs in this case) into Elasticsearch and then using Kibana to search them. I am not using logstash for this.

There is a field titled "sourceIPAddress" which is defined in all the index mappings as:

"sourceIPAddress" : {
    "type" : "ip"
}

This works for indexing and searching in Kibana, however Kibana states that this field is in conflict.

The index patterns page says that it changes in some indices but I'm unable to find the indices where it doesn't work. The only thing I can think of is that some events have no ' sourceIPAddress' field set at all but that doesn't seem like it should break my ability to use visualize on it.

Can anybody offer some guidance?

[cjcenizal]

Hi Marky, from a quick Google search for "kibana field conflict", I found these links which sound like the same thing you're describing:

Mapping conflict!

Dear community, I have a mapping conflicts in across our indices (separated on a daily basis): Mapping conflict! A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require re-indexing your data. Yesterday I changed via logstash % {NUMBER: bytes: int} a…

How to fix mapping conflict?

I have a few fields (bytesSent, bytesReceived, timetaken) that show mapping conflicts, and thus I cannot visualize them in Kibana. All of these log entries are going to an index "logstash-*" I am pretty green at this, so how would I go about finding all of the conflicting indexes and fixing or removing them? Here is part of the grok expression used for these conflicting fields in Logstash: %{NUMBER:bytesSent} %{NUMBER:bytesReceived} %{NUMBER:timetaken} And then a mutate (is this even nec…

Issue: Mapping conflict! 14 fields are defined as several types

How to find fields with mapping conflicts

https://dev.sobeslavsky.net/kibana-how-to-solve-mapping-conflict/

The common answer to this problem is to reindex your data. Please try that and let me know if it helps!

Thanks,
CJ

[marky]

Hi CJ,

Thanks for the response. I'm curious if there's a way to identify which document(s) caused the mapping conflict to begin with. Do you know of any ways to identify what document(s) or even indices may have caused the conflict?

[cjcenizal]

Unfortunately, there's no easy way to do that, from what I can tell.