I've got "normal" ('use_name') and "bad" (user_name, username.keyword) mapping results using the same mapping json-object (based on mapping (user_name: { type: 'keyword' }) in Node.js. It happened when I created a new index and sent mapping for this index. I implemented index template and sent mapping just one time creating this template. After that new indices re-used this mapping. After these changes i see just "normal" mapping on Kibana side at least for a couple days since I implemented it. You may find my mapping below. A code below is a part of Node.js
. . .
const mappings = {
log: {
properties: {
ts: { type: 'date' },
opID: { type: 'keyword' },
trqID: { type: 'keyword' },
pmID: { type: 'keyword' },
vpID: { type: 'keyword' },
user_name: { type: 'keyword' },
tpath: { type: 'keyword' },
retCode: { type: 'integer' },
fd: { type: 'integer' },
length: { type: 'long' },
offset: { type: 'long' },
read_size: { type: 'long' },
write_size: { type: 'long' },
flags: { type: 'integer' },
mode: { type: 'integer' },
old_tpath: { type: 'text' },
new_tpath: { type: 'text' },
mount_path: { type: 'text' },
truncate: { type: 'long' },
devType: {type: 'integer' },
uid: { type: 'integer' },
gid: { type: 'integer' },
stpath: { type: 'text' },
dtpath: { type: 'text' },
atime: {
type: 'nested',
properties: {
sec: { type: 'long' },
nsec: { type: 'long' },
},
},
mtime: {
type: 'nested',
properties: {
sec: { type: 'long' },
nsec: { type: 'long' },
},
},
},
},
};
. . .