@timestamp conflicts with existing mapping in eleasticsearch 2

Elastic Stack Elasticsearch
1

Hi all

I have an ELK test environment with two different log type.

I migrated from elasticsearch 1.7 to 2.x without problem, but trying to add a third log type I had the following error in elasticsearch log

** at java.lang.Thread.run(Thread.java:745)**
[2015-12-22 14:34:30,413][DEBUG][action.admin.indices.mapping.put] [Sise-Neg] failed to put mappings on indices [[logstash-dco-2015.12.21]], type [dco_com]
java.lang.IllegalArgumentException: Mapper for [@timestamp] conflicts with existing mapping in other types:
[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]

The config can for the log added is the following http://pastebin.com/raw/v1PuUr05

I expect the field DCO_TIMESTAMP is automatically converted in the DATE plugin.

Something in the config is wrong?

Thanks in advance

Giuseppe

2

What's the mapping on the existing field look like?

3

I am having this same issue in production.

We have already have data in the indexes when we upgraded from Elasticsearch 1.6 to 2.1.0. Now when trying to add the new types in the already existing indexes, there is the conflict stated above

The default mapping before upgrade is:

"_default_": {
    "dynamic_templates": [
      {
        "string_fields": {
          "mapping": {
            "index": "analyzed",
            "omit_norms": true,
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }
            }
          },
          "match_mapping_type": "string",
          "match": "*"
        }
      }
    ],
    "_timestamp": {

    },
    "_all": {
      "enabled": true
    },
    "properties": {
      "geoip": {
        "dynamic": "true",
        "properties": {
          "location": {
            "type": "geo_point"
          }
        }
      },
      "@version": {
        "index": "not_analyzed",
        "type": "string"
      }
    }
  },

After the upgrade to new Elasticsearch, the defualt mapping for newly formed indexed have changed to : http://pastebin.com/yFBdWqAz

which works fine for newly created types in the same index with the new default mapping. I am transforming the timestamp with the date filter aswell.

4

Did you read 2.X breaking changes? Also it'd be better if you started your own thread :slight_smile:

5

For index cretaed before migration I see

"@timestamp": {
"type": "date",
"format": "epoch_millis||dateOptionalTime"
},

complete mapping here
For index created after migration I see

"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}

complete mapping here