Mapping Conflict Issue

Elastic Stack Elasticsearch
1

If data type of field is changed in logstash configuration then is it required to create new index every time to get the changes apply?
Ex. Field "pauseTime" is extracted using KV filter. Data type of the field is changed from string to number, changes are getting applied to the rollover index and not to the current index even with continuous log ingestion. This caused conflict issue.

However, I have converted another field from string to date which was extracted using grok pattern, changes reflected immediately.

2

Hi Shivani,

Below document answers your queries:

Except for supported mapping parameters, you can’t change the mapping or field type of an existing field. Changing an existing field could invalidate data that’s already indexed.

If you need to change the mapping of a field in other indices, create a new index with the correct mapping and reindex your data into that index.

Hope this helps you!