Kibana splits hostname on DOTS

Elastic Stack Elasticsearch
1

Hi,
I have a n00b question.
I have a mapping defined as

{
"logstash-2014.04.29" : {
"mappings" : {
"X_Server" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {"type" : "string" },
"file" : {"type" : "string" },
"host" : { "type" : "string"},
"message" : {"type" : "string"}
}
}
}
}

}

In Kibana, I do see that host gets split on dots(".") . I went through
links, and can see that I have to update the mapping for host index as
"not_analyzed".
I am unable to update the mapping after issuing this command

curl -XPUT 'http://localhost:9200/logstash-2014.04.29*/X_server*/_mapping'
-d '
{
"X_server" : { "properties": { "host" : { "type": "string", "index":
"not_analyzed"}}}
}

Here is the error I am getting

[2014-04-28 18:15:04,043][DEBUG][action.admin.indices.mapping.put] [Node1]
failed to put mappings on indices [[logstash-2014.04.29]], type [X_server]
org.elasticsearch.index.mapper.MergeMappingException: Merge failed with
failures {[mapper [host] has different index values, mapper [host] has
different norms.enabled values, mapper [host] has different tokenize
values, mapper [host] has different index_analyzer]}

Can anyone point me what am I doing wrong ?

Thanks,

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/afce94c3-5fcf-46b7-aaf2-d460186290bd%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

You aren't doing anything wrong. Elasticsearch is just telling you that you
have attempted to change the mapping to one that is not compatible with the
current mapping.

I believe that the best advice would be to export / snapshot the data, then
delete and re-add the index with the corrected mapping, and then reload the
data. Then your existing data along with your new data will all be
consistently searchable.

Brian

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4eea02ad-3e39-4df9-88c5-59a37eec9779%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.