Numeric value being detected as long instead of intended string

Elastic Stack Elasticsearch
1

I seem to be having an odd issue with my data typing in Elasticsearch, I have a "timestamp" field (not "@timestamp") in one type (apachecombined-access) that is being set as "string" and in another type (rds-logs) as a "long". The problem is that I can't see anything in my index template that would cause this to happen and I don't have automatic numeric detection enabled.

You can view my index template here: http://pastebin.com/wHQdmxjP

Sample _source of an "apachecombined-access" type item: http://pastebin.com/BfkG5Lx0
Sample _source of an "rds" type item: http://pastebin.com/qe2TxHBB

Does anyone see what could be causing my issue? I appreciate any help!

2

Hi,

Your "rds" type item has the number type in your JSON that means without ".
It is not related numeric detection.

See this document.
https://www.elastic.co/guide/en/elasticsearch/guide/2.x/mapping-intro.html#core-fields

3

Thank you for the reply @johtani. Regardless of the JSON type of the data i was inserting, I wanted to ensure that anything non-object value that wasn't explicitly suffixed with a type (as per my index template), would automatically get typed as a string.

It seems like I've been able to solve my problem by doing a few slight modifications to the index templates. I went from this 1st version template to this 2nd version template.

I suspect the "nested_items_template" section in the 1st version was allowing ES to automatically convert "timestamp": 1234567890 to a long as it's JSON type was a number (as you pointed out) and I was also using the {dynamic_type} value for type. I updated that section in the 2nd version template to only automatically detect object types and statically set them to "object". It seems like new values that don't match my indicated types (with _TYPE) or the object type, now match on last "string_fields" section, thus properly setting it as a string. I'm not an expert when it comes to index templates although I would appreciate it if you can in fact confirm this is what's occurring?

Thanks again.