Template .monitoring-es conflicts with my template

Elastic Stack Elasticsearch
1

By using ES 5.5 with x-pack installed, I got so many error log telling timestamp mapper conflicts:

[2017-08-18T11:43:24,474][WARN ][o.e.x.m.e.l.LocalExporter] unexpected error while indexing monitoring document
org.elasticsearch.xpack.monitoring.exporter.ExportException: java.lang.IllegalArgumentException: Mapper for [timestamp] conflicts with existing mapping in other types:
[mapper [timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]
        at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk.lambda$throwExportException$2(LocalBulk.java:130) ~[x-pack-5.5.0.jar:5.5.0]
        at org.elasticsearch.xpack.monitoring.exporter.local.LocalBulk$$Lambda$2137/1860532805.apply(Unknown Source) ~[?:?]

Just a wild guess,I think the reason was template .monitoring-es conflicts with my template
x-pack generated a template like this for the monitor index

  ".monitoring-es": {
    "order": 0,
    "version": 5050099,
    "template": ".monitoring-es-6-*",
  "mappings": {
      "doc": {
        "properties": {
          "timestamp": {
            "format": "date_time",
            "type": "date"
          }
        }
      }
    }
....

I have a template like this, for my indices:

   "t1":{
   "template" : "*",
    "order": 0,
    "mappings": {
      "log": {
        "properties": {
          "timestamp": {
            "format": "epoch_millis",
            "type": "date"
          }
...

If what I suspect is correct, puting new high order template shoud work, which it didn't.
what shoud be done? @warkolm thanks for helping.

curl -XPUT http://xxxx:9400/_template/fix_monitor?master_timeout=5m '-d
{
  "template" : ".monitoring-es-6-*", // same template name,but high oder 
  "order": 1,
    "mappings": {
      "doc": {
        "properties": {
          "timestamp": {
            "format": "date_time",
            "type": "date"
          }
        }
      }
    }
}'
2

The error is from the x-pack monitoring exporter agent indexing a document which means the index is already created. Please try deleting the most recent .monitoring-es-6 index. The new high order template will be used when the index is recreated and it should have the correct mapping.

3

I tried delete the index ,then the es crushs, saying elasticsearch is still initializing the monitor index (something like that).
I also gave one issue on github here, actually I did understand what he has explained:

It didn't work because fields with same name but different type must have the same settings (see #11812), in order to avoid all kind of inconsistencies when querying the field. In your case, the custom template is applied to the monitoring indices too (but it should not) and it causes the conflict.

I do hava the same settings for the two mapping , right?

4

They are slightly different having different formats-- epcoch_millis vs. date_time. This is enough to cause a conflict.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.