# Reserved field names **URL:** \ **Category:** Elasticsearch\ **Created:** [June 1, 2016, 3:07pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575 "2016-06-01T15:07:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [June 1, 2016, 3:07pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/1 "2016-06-01T15:07:25Z")
We have been planning to upgrade from 1.7.1 to 2.3 but we do not seem to pass the Migration Checker I am having two issues marked as Red and I do not know how to address them yet. Please help. Some of the indices are flagged using Reserved field names: issue 1: Reserved field names The \_uid, \_id, \_type, \_source, \_all, \_parent, \_field\_names, \_routing, \_index, \_size, \_timestamp, and \_ttl field names are reserved and can no longer be used in the document \_source., in type: logs. issue 2: Conflicting field mappings Mapping for field dashboard:hits conflicts with: search:hits. Check parameter: type Please help ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [June 1, 2016, 3:32pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/2 "2016-06-01T15:32:45Z")
Hi, - issue1: the mentioned field names appear somewhere in your documents, but are not legal in 2.x any more, so you need to rename those fields. You need to reindex your data, also because of the following issue. - issue2: this means you two different mappings for the field "hits" in type dashboard and in type "search". This is no longer possible with ES 2.x. This [blog article](https://www.elastic.co/blog/great-mapping-refactoring) explains why. Unfortunately the only solution is to reindex your data into a new index with corrected mappings ---
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [June 10, 2016, 4:18pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/3 "2016-06-10T16:18:50Z")
Hi Chris I am new to ELK, I just found out that we do not use these reserved field names ( uid, \_id, \_type, \_source, \_all, \_parent, \_fieldnames, \_routing, \_index, \_size, \_timestamp), what is the best way to remove them? ---
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [June 13, 2016, 8:51pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/4 "2016-06-13T20:51:58Z")
Please help I try to use the filter and rename as listed below to re-index using logstash but it does not work mutate { rename =\> { "\_uid" =\> "uid" } rename =\> { "\_id" =\> "id" } rename =\> { "\_type" =\> "type" } rename =\> { "\_source" =\> "source" } rename =\> { "\_all" =\> "all" } rename =\> { "\_parent" =\> "parent" } rename =\> { "\_field\_names" =\> "fielnames" } rename =\> { "\_routing" =\> "routing" } rename =\> { "\_index" =\> "index" } rename =\> { "\_size" =\> "size" } rename =\> { "\_timestamp" =\> "timestamp" } rename =\> { "\_ttl" =\> "ttl" } } I ran the migration check and it still showing Reserved field names The \_uid, \_id, \_type, \_source, \_all, \_parent, \_field\_names, \_routing, \_index, \_size, \_timestamp, and \_ttl field names are reserved and can no longer be used in the document \_source., in type: logs. ---
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [June 22, 2016, 5:22pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/5 "2016-06-22T17:22:42Z")
Any help please, we're still dealing with this issue Thanks ---
**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Post date:** [June 22, 2016, 5:39pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/6 "2016-06-22T17:39:23Z")
I can't really tell what you did, but when you did the transformation you'll need to make a new index and delete the old one. Once you add a field to an index it can never be removed from the mapping. ---
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [June 24, 2016, 3:40pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/7 "2016-06-24T15:40:45Z")
This is what I did to re-index using logstash but it does not work input { elasticsearch { hosts =\> ["[elasticsearch.prod.xxx:9200](http://elasticsearch.prod.xxx:9200)" ] index =\> "index-2016.05.22" size =\> 500 scroll =\> "5m" docinfo =\> true } } filter { ruby { init =\> " def remove\_dots hash new = Hash.new hash.each { |k,v| if v.is\_a? Hash v = remove\_dots(v) end new[k.gsub('.','_')] = v if v.is\_a? Array v.each { |elem| if elem.is\_a? Hash elem = remove\_dots(elem) end new[k.gsub('.','_')] = elem } unless v.nil? end } unless hash.nil? return new end " code =\> " event.instance\_variable\_set(:@data,remove\_dots(event.to\_hash)) " } mutate { rename =\> { "\_uid" =\> "uid" } rename =\> { "\_id" =\> "id" } rename =\> { "\_type" =\> "type" } rename =\> { "\_source" =\> "source" } rename =\> { "\_all" =\> "all" } rename =\> { "\_parent" =\> "parent" } rename =\> { "\_field\_names" =\> "fielnames" } rename =\> { "\_routing" =\> "routing" } rename =\> { "\_index" =\> "index" } rename =\> { "\_size" =\> "size" } rename =\> { "\_timestamp" =\> "timestamp" } rename =\> { "\_ttl" =\> "ttl" } } } output { elasticsearch { hosts =\> ["remote.cluster"] index =\> "%{[@metadata][\_index]}" document\_type =\> "%{[@metadata][\_type]}" document\_id =\> "%{[@metadata][\_id]}" } stdout { codec =\> "dots" } } ---
**Author:** ![genesis](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@genesis](https://discuss.elastic.co/u/genesis)\ **Post date:** [July 1, 2016, 1:49pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/8 "2016-07-01T13:49:08Z")
Nik and team anymore thoughts on this issue? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:38pm UTC](https://discuss.elastic.co/t/reserved-field-names/51575/9 "2017-07-05T22:38:55Z")