Mapping conflict 4 fields are defined as several types ----

[Swathi12]

Hello

i found this error in Kibana -> Stack Management

Mapping conflict

4 fields are defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data.```

Not sure how to solve this. Can you help here please?

[rugenl (Len Rugen)]

For each field, find what is the proper type. Why is Elastic seeing different types?

Some reasons:

. Elastic guesses the field type based on the first event ingested. If it's a string field and it sees numbers first, it guesses wrong. Define mapping for the filed to fix.

. Same field name from different data sources but fields are of different format. Fix a data source, map or split into different fields.

When you define mapping for the fields, the index will have to "roll over" for the mapping to take effect. If you want the old data fixed, you have to reindex.

[Swathi12]

Thank you @rugenl
i have example here:

Can you tell how exactly i have to solve this? -i never did before

[rugenl (Len Rugen)]

It might be easiest to get all on the same version of metricbeat. You probably have no control over those fields,

Should he different versions go into different data streams?

[Ayush_Mathur]

By logic, limit_in_bytes must be long type field and should not be stored as Text. So to resolve the above, you need to:

1. update your index template and provide mapping explicitly as long for this field
2. reindex the 2 indices mentioned in keyword to a new index. The new index will store the values as long since you updated the template mapping.
3. Provide alias to your new index (regex or common part of indices should be OK since patterns is created out of it).
4. Delete the old indices which are mentioned in keyword part.

[Swathi12]

@Ayush_Mathur

1. i am not sure where and how to update the index template..

2. i just try this way but its not working and the error field i can't delete

3. can not delete the wrong field also
   
   

[Ayush_Mathur]

@Swathi12 do the following:

1. get your index details using GET ${YOUR_INDEX_NAME} -> the output will show you the index template being used, copy the name of template.
2. GET _index_template/${YOUR_INDEX_TEMPLATE} -> this will give you settings+mappings defined for your index template, copy the relevant section for conflicting field.
3. `PUT _index_template/${YOUR_INDEX_TEMPLATE} { "template": { "mappings": { "properties" : { "${YOUR_FILD_NAME}": { "type" : "long" } } } } } -> you should get acknowledgement as output.
4. Create a new index following the regex or index_pattern defined for ${YOUR_INDEX_TEMPLATE} by: PUT ${NEW_INDEX_NAME}.
5. Reindex you data from conflicting indices to the new index created in Step # 4 following: Reindex API | Elasticsearch Guide [8.6] | Elastic
6. Delete the older or conflicting indices once reindexing is complete.