Template Field Mapping Not Taking

Elastic Stack Elasticsearch
1

I am trying to create some new fields in one of our elasticsearch indices mapped as an integer. Today, I created that field in our template mapping (applied via logstash), mapped as an integer, something like:

{
"templatename": {
"aliases": {},
"mappings": {
"syslog": {
"properties": {
"Active": {
"type": "integer"
},
"Missing": {
"type": "integer"
},
"Running": {
"type": "integer"
}
}
}
},
"order": 0,
"settings": {
"index": {
"refresh_interval": "5s"
}
},
"template": "matching_templatename"
}
}

Before we inserted ANY data using these fieldnames, I checked the template mapping on the ES server and saw these fields there in it, mapped as integers, and yet when we inserted our first piece of data using those field names, they initialized themselves as strings in the index mapping. I'm certain that the index name matches the template, as I've used this template to set other fields as not_analayzed before. What possible reasons are there for this??

Another question, if I set a field in a template, should I expect to see that field show up in the mapping of a particular index that it applies to, BEFORE any data using that field name has passed through??

Any help appreciated!!

Thanks

2

Are you sure the type from ES matches the mapping - syslog?

3

Yes. In fact the next day the mapping took appropriately which is really weird. I suspect that maybe because in the same change in which we added the two integer fields to the mapping, we also removed two OTHER fields from it and maybe this created some kind of incompatibility?? Really not sure, but it is working now.

Thanks!