Why ingest pipline first field is default date, How can I set it string?

[kiddingl]

My kibane and es version is 7.8.0
I create a pipline on kibana dashboard

{
  "description": "test",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{DATA:a1} %{GREEDYDATA:content}"],
        "on_failure": [
          {
            "set": {
              "field": "grok_fail_message",
              "value": "{{_ingest.on_failure_message }}"
            }
          }
        ]
      }
      
    },
    {
  "remove": {
    "field": ["log.offset","input.type","_type"]
  }
}
    ]
  
}

I get the response:

{
  "acknowledged" : true
}

I found the a1 type is alwyas date , why did appear it:

[kiddingl]

Look this:

[stephenb (Stephen Brown)]

Most likely because the first field that got processed and inserted fit the date format and so Elasticsearch automatically created that field as a type date...

If you want to make sure keyword or text? Create a mapping ahead of time.

Or you can use the mutate convert to set the type to string

[kiddingl]

The pipline is ingest node pipline and not logstash pipline; I try to change a1 type is string ,but it't not activate, base on Convert processor | Elasticsearch Guide [8.2] | Elastic

[stephenb (Stephen Brown)]

Apologies should have noticed ingest pipeline.

Create a mapping that is the most prescriptive... The same thing is probably happening.. Even though you convert to a string, it has a date format so it's probably getting automatically converted when it's written into a date by automatic date detection

You will need to delete the current index because once it's set it won't change.

Explicitly Add the a1 field to the filebeat template as a text or keyword

If you had run ./filebeat setup -e per the quick start guide the default filebeat template would have set date "date_detection": false, and this would not be happening.

Or you can create a mapping and set "date_detection": false,