Mapping Conflict with Several Types

[JakBains (Jak)]

Hello - my organization recently had an issue where the latest index in our datastream from logstash has the wrong mappings. This has made our IP addresses and geopoints appear as text and keyword types, as a result many of our dashboards in Kibana are no longer working. I was wondering what would be the best solution for this problem? And what might have caused this issue to begin with?

I’m also receiving the following message in the discover menu of Kibana:

“This field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use this conflicting field, but it will be unavailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data.”

Thanks in advance!

[warkolm (Mark Walkom)]

Welcome to our community!

Your best option is to use Index templates | Elasticsearch Guide [8.4] | Elastic to define things ahead of time. However your datastream should already be using one?

[JakBains (Jak)]

Thanks!

I've actually resolved the issue we were having. I did this by copying the mappings from an older index in the datastream to the mappings in the index template, then I forced a rollover. Following that I reindexed the broken indices to the datastream. Then I deleted the broken indices.