Mapping not respected

Elastic Stack Elasticsearch
1

Hi,

In Elastic 7.9.1I have this template (which is considered 'legacy' for some reason) which has several mappings like for example this one:
image

However, when I look at the actual index I see everything is mapped as text.

        "app-id": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "client-ip": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "ecs": {
          "properties": {
            "version": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            }
          }
        },
        "event-type": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "execution-time": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },

What may cause this?

2

Is the screenshot of the template, or the applied mapping?

3

Template.
Here screenshot of what it says in json for that execution-time field

image
image504×748 27.3 KB

I now tried to switch off dynamic mapping and this does the trick.
So with dynamic mapping on in the template, my own mappings are overruled?

4

Templates take priority over dynamic mapping.

5

Well, not with me. After disabling dynamic mapping the mapping in the templates is applied.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.