Re-mapping field type from date to text

Elastic Stack Elasticsearch
1

Hi,

Due to the changes in our application logging, one of the JSON fieldslevel1.level2.level3.version has changed its format from date-like "2018-05-23" to URL+date format like "https://CDN.server.com/template#2018-06-21". The initial field mapping was auto-generated by Elasticsearch server with type "date" and now it has recognized it as a "text" and marked the field with "conflict" type.

Now, when I do the search in Kibana, one of the shards is reported as having failure and the reason is

Fielddata is disabled on text fields by default. Set fielddata=true on [level1.level2.level3.version] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

By checking the index patterns in Kibana for that field, I can see that both level1.level2.level3.version and level1.level2.level3.version.keyword are created, but both are marked as searchable and aggregatable. I guess that only the keyword field should be aggregatable and that is what the error message is trying to say.

How can I mark the original field to be not aggregatable and re-map the history data into new format?

2

Hey Victor,

You are correct, keyword fields are not analyzed and can be used for aggregations and sorting.

I believe you need to setup a new mapping as you can't change the mapping of an existing field. Which means you'll have to reindex as well.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.