@timestamp conflicts with existing mapping in eleasticsearch 2.1.0

Elastic Stack Elasticsearch
1

I am having this same issue in production.

We have already have data in the indexes when we upgraded from Elasticsearch 1.6 to 2.1.0. Now when trying to add the new types in the already existing indexes, there is the conflict stated above

The default mapping before upgrade is:

"_default_": {
    "dynamic_templates": [
      {
        "string_fields": {
          "mapping": {
            "index": "analyzed",
            "omit_norms": true,
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }
            }
          },
          "match_mapping_type": "string",
          "match": "*"
        }
      }
    ],
    "_timestamp": {

    },
    "_all": {
      "enabled": true
    },
    "properties": {
      "geoip": {
        "dynamic": "true",
        "properties": {
          "location": {
            "type": "geo_point"
          }
        }
      },
      "@version": {
        "index": "not_analyzed",
        "type": "string"
      }
    }
  },

After the upgrade to new Elasticsearch, the defualt mapping for newly formed indexed have changed to : http://pastebin.com/yFBdWqAz

which works fine for newly created types in the same index with the new default mapping. I am transforming the timestamp with the date filter aswell.

2

I tested out the https://github.com/elastic/elasticsearch-migration plugin in production before upgrading the Elasticsearch. The results from the plugin had no issues for upgrade.

Also, the @timestamp field type is same across all the the types in our Elasticsearch indexes

3

I suspect this would be addressed by https://github.com/elastic/elasticsearch/pull/15633, but this change won't be released soon. In the mean time, I would recommend to map your @timestamp field explicitly and to use the exact same mapping definition for new types as the mapping definition that already exists in your other types.

4

Thanks for the suggestion. Although, Sorry, I forgot to mention the error:

"error"=>{"type"=>"illegal_argument_exception", "reason"=>"Mapper for [@timestamp] conflicts with existing mapping in other types:\n[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]"}}}, :level=>:warn}

I got collected in logstash.log file

Does this error makes more things clear?