Mapping on Index names with Date

Elastic Stack Elasticsearch
1

I have a document which I index this way:

POST notifications/file
{
"system" : "server 1",
"date" : "2017-04-04 10:00:00"
}

The date was mapped dynamically to string. In order to utilize the date in Kibana, I did this prior to indexing:

PUT notifications
{
"mappings": {
"file": {
"properties": {
"date": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
}
}
}
}
}

That would be all fine but then I read in the examples that they are using Index names with date, such as:

POST notifications-2017.04.04/file
{
"system" : "server 1",
"date" : "2017-04-04 10:00:00"
}

The problem now is when I do the following using the same PUT data (as above):

PUT notifications *

If I do it before indexing the first POST data, it complains of an invalid index name format.
If after, it complains that the 'date' field has a type "string" already.
I'd like the mapping to reflect on indices that will be generated in the future.

I'm reading the Dynamic Mapping topic from the Documentation, they don't have examples that fit my scenario.
I'd like to know how to implement mapping with this kind of Index name?

2

It sounds like what you want is a dynamic template, which will apply some settings/mappings every time a new index is created that matches the template. For example:

PUT /_template/notification-template
{
  "template": "notification-*",
  "mappings": {
    "file": {
      "properties": {
        "date": {
          "type": "date",
          "format": "yyyy-MM-dd HH:mm:ss"
        }
      }
    }
  }
}

The notification-* means that the template will be applied every time a new index starting with "notification-" is created.

2 Likes
3

It worked. Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.