Mapping conflict with alias field for IP

Elastic Stack Kibana
1

Hi, I am collecting access logs from different web proxies in elasticsearch. Depending on the software running they come with different fields. For example the http response code returned to the user is in the "code" field in documents from my apache2 servers while it is in the "DownstreamStatus" field in documents from traefik. I now want to visualize all access logs together in kibana so I added some field type mappings to my traefik access logs index template. For the example above I have added mappings like so

{
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "DownstreamStatus": {
          "type": "keyword"
        }, ...
        "code": {
          "path": "DownstreamStatus",
          "type": "alias"
        }, ...
      }
    }
  }
}

This works great except for one field. The clients IP address. This field is mapped like so

{
  "template": {
    "mappings": {
      "properties": {
        "ClientHost": {
          "type": "ip"
        },
        "host": {
          "path": "ClientHost",
          "type": "alias"
        }
      }
    }
  }
}

But when I create a Data View that contains both indices with apache and traefik access logs I get a conflict
" The type of the host field changes across indices and might not be available for search, visualizations, and other analysis."
All my apache indices are shown to have this field as type IP while the traefik indices have it as type object. Why does this happen? What am I missing here?
I am running elasticsearch and kibana both on version 9.0.2

2

This means that the mapping for the field host field is different accross different indices on the same data view, this leads to a conflict and this field cannot be used until the mapping conflict is solved, you cannot have the same field with different mappings accross different indices on the same data view.

To solve this you need to have the same mapping for the field in both indices.

How are you indexing your data for each of those data sources?

I'm assuming that on the other data source you have something like host.ip, so this may work, but I'm not sure a I do not use field alias.

"host" {
    "properties": {
        "ip": {
            "type": "alias",
            "path": "ClientHost"
        }
    }
}
3

Thanks for the response but I feel like I have not described my problem clearly. I have 2 indices apache and traefik. apache has a field host that is mapped as type "IP" like so

    "mappings": {
      "properties": {
        "host": {
          "type": "ip"
        }
      }

traefik does not have a field called host. The same information is instead in a field called ClientHost. Since I wish to combine both indices in the same data view I have added an alias field mapping to traefik. The relevant mappings for traefik look like this:

    "mappings": {
      "properties": {
        "ClientHost": {
          "type": "ip"
        },
        "host": {
          "type": "alias",
          "path": "ClientHost"
        }
      }
    }

This leads to the conflict described above where the host field has type object in the traefik index. Can I somehow determine what type an alias will have?

I am also confused because for other keyword fields, like my example with code and DownstreamStaus above, this works fine. It just fails for the IP field

4

After writing this I realized it was just because I had old data in my index that had dynamically mapped ClientHost to be of type object :sweat_smile: cleaned that up and all new data came in correctly. Sorry, should have thought of that immediately