In my organisation, many application coders use elasticsearch both for indexing and searching. In an effort to not do the same work over and over again and also to share data, we are trying to collect some of the indices, which contain the same data, and turn them into a single index.
We have run into a problem with the date fields: Some applications index dates as integers (e.g. milliseconds_after_epoch), while other use ISO8601 (or some other string-like format). This works perfectly fine for indexing, as seen by the following curls:
curl -XPUT 'http://localhost:9200/index3' -H 'content-type:application/json' -d '{"mappings": {"properties": {"my_date": { "type": "date" } } } }'
curl -XPUT 'http://localhost:9200/index3/_doc/1' -H 'content-type:application/json' -d '{"my_date" : 123456789000}'
curl -XPUT 'http://localhost:9200/index3/_doc/2' -H 'content-type:application/json' -d '{"my_date" : "2015-01-01T12:10:30Z"}'
However, when the applications try to query the index, the return type is now sometimes integers, and sometimes strings, leading all applications which use the new, combined index as input to crash!
So: Is there any way for us to control the format of the "my_date" field of the _source structure of the query replies (which most of the applications explicitly reference)? E.g. specify that my_date should always be in ISO8601 format, whatever format was used at indexing time?
Note that I know how to do this with a painless script at query time, but AFAIK it does not allow me to update the _source structure of the reply, only add a new field. This may be the best solution, but it is definitely suboptimal, since it still involves rewriting application code...