@timestamp conflicts with existing mapping in eleasticsearch 2


(Giuseppe Tricarico) #1

Hi all

I have an ELK test environment with two different log type.

I migrated from elasticsearch 1.7 to 2.x without problem, but trying to add a third log type I had the following error in elasticsearch log

** at java.lang.Thread.run(Thread.java:745)**
[2015-12-22 14:34:30,413][DEBUG][action.admin.indices.mapping.put] [Sise-Neg] failed to put mappings on indices [[logstash-dco-2015.12.21]], type [dco_com]
java.lang.IllegalArgumentException: Mapper for [@timestamp] conflicts with existing mapping in other types:
[mapper [@timestamp] is used by multiple types. Set update_all_types to true to update [format] across all types.]

The config can for the log added is the following http://pastebin.com/raw/v1PuUr05

I expect the field DCO_TIMESTAMP is automatically converted in the DATE plugin.

Something in the config is wrong?

Thanks in advance

Giuseppe


(Mark Walkom) #2

What's the mapping on the existing field look like?


(Inderjeet Singh) #3

I am having this same issue in production.

We have already have data in the indexes when we upgraded from Elasticsearch 1.6 to 2.1.0. Now when trying to add the new types in the already existing indexes, there is the conflict stated above

The default mapping before upgrade is:

"_default_": {
    "dynamic_templates": [
      {
        "string_fields": {
          "mapping": {
            "index": "analyzed",
            "omit_norms": true,
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }
            }
          },
          "match_mapping_type": "string",
          "match": "*"
        }
      }
    ],
    "_timestamp": {

    },
    "_all": {
      "enabled": true
    },
    "properties": {
      "geoip": {
        "dynamic": "true",
        "properties": {
          "location": {
            "type": "geo_point"
          }
        }
      },
      "@version": {
        "index": "not_analyzed",
        "type": "string"
      }
    }
  },

After the upgrade to new Elasticsearch, the defualt mapping for newly formed indexed have changed to : http://pastebin.com/yFBdWqAz

which works fine for newly created types in the same index with the new default mapping. I am transforming the timestamp with the date filter aswell.


(Mark Walkom) #4

Did you read 2.X breaking changes? Also it'd be better if you started your own thread :slight_smile:


(Giuseppe Tricarico) #5

For index cretaed before migration I see

"@timestamp": {
"type": "date",
"format": "epoch_millis||dateOptionalTime"
},

complete mapping here
For index created after migration I see

"@timestamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}

complete mapping here


(system) #6