Reindexing with new field mapping still keeps bytes field as string

Elastic Stack Elasticsearch
1

Hi all,

I’m trying to have some json fields typed/mapped as integer, but they keep ending up in Elastic as text fields. My setup:

Apache > logfile.json > filebeat > … Other side -> logstash > Elastic (6.7) > Kibana

My data is already parsed as json in Elastic so all fields are separately stored. The bytes fields are showing in the mapping defined as integers. However, looking at the data of a particular document in that index, they still appear as text fields. Anybody know what I’m missing?

I added my mapping that has the integer fields defined, but they don’t seem to work.

nb: I’ve tried to replace the mapping type name from _default_ to doc, _doc and others, but still now luck.

Thanks a lot for any pointers!! :slight_smile:

Relevant source

Mapping template

reindex json code

My test workflow

The sequence I follow for testing the mapping on the target destination

Delete target test index
curl -H 'Content-Type: application/json' -XDELETE http://127.0.0.1:9200/logstash-test-2019.05.10?pretty=true | jq .

Upload new mapping with bytes fields as integers
curl -H 'Content-Type: application/json' -XPUT 'http://127.0.0.1:9200/_template/logstash' -d @logstash-test-automapping.json | jq .

Reindex to target test index
curl -H 'Content-Type: application/json' -XPOST 'http://127.0.0.1:9200/_reindex' -d @reindex.json

Show the test mapping - Showing bytes fields as type integer
curl -H 'Content-Type: application/json' -XGET http://127.0.0.1:9200/logstash-test-2019.05.10?pretty=true | jq .

Getting a document from that index
curl -H 'Content-Type: application/json' -XGET http://127.0.0.1:9200/logstash-test-2019.05.10/_doc/ajQvpGoBz9QwF2Bdc9_I?pretty=true | jq .

2

Ok, and not totally weird because bytes sent could not be a negative, the problem is that bytes sent should be a float instead of a (signed) integer.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.