How to find fields with mapping conflicts

Question

My index settings in Kibana tell me that I have fields with mapping conflicts in my logstash-* index patterns.

What is the easiest way to find out which fields have a conflicting mapping and/or in which indices the conflict occurs?

Answer 1

As of at least Kibana 5.2, you can type "conflict" into the Filter field, which will filter all fields down to only those which have a conflict. At the far right there is a column named "controls", and for each field it has a button with a pencil icon. Clicking that will tell you which indices have which mapping.

Fields filtered to only those with conflicts:

Indices in which field mapping conflicts:

Answer 2

You can easily find how fields are mapped using the mapping API in Kibana.

If you know you have a mapping conflict, I will assume you know the field name that has the conflict. These will be listed under Management/Index Patterns/index_pattern

If you have indices that are created daily, such as production-2020.06.16, you can search across all the indices with production*.

Go to Dev Tools and enter this query, changing the index pattern (production*) and conflictedFieldname to suit your needs.

GET production*/_mapping/field/conflictedFieldname

This will pull all indices that match the production* pattern and will list the mapping for conflictedFieldname for each index. Scroll through and see which one is not like the other one.

You can also check out the Elasticsearch documentation here: Elasticsearch documentation: Get Field Mapping API

The reason you're getting a conflict is because the first value that goes into the index is used by Elasticsearch to make its best guess as to what data type it should be. You can ensure it is always the same type by placing a template for the index pattern you are concerned with.

Elasticsearch documentation: Put Index Template