Skip to content

Conversation

@jbaiera
Copy link
Member

@jbaiera jbaiera commented May 11, 2023

When data streams are created, they provide a synthetic mapping template that will add an @timestamp field to the mappings by default if there isn't one already defined. This field on a data stream is incompatible with the ignore_malformed parameter which might be set true at the indexing layer somewhere else on the template.

In order to avoid failing to create the data stream when the mappings are merged, this PR updates the implicit @timestamp field to set ignore_malformed=false in case it is configured true at the index-wide setting.

@elasticsearchmachine
Copy link
Collaborator

Hi @jbaiera, I've created a changelog YAML for you.

@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-data-management (Team:Data Management)

@elasticsearchmachine elasticsearchmachine added the Team:Data Management Meta label for data/management team label May 12, 2023
Copy link
Member

@dakrone dakrone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jbaiera jbaiera merged commit 9ff5a12 into elastic:main May 12, 2023
@jbaiera jbaiera deleted the data-stream-implicit-timestamp-ignore-setting branch May 12, 2023 17:34
romseygeek added a commit that referenced this pull request Sep 13, 2023
…ields (#99346) Data-stream mappings require a @timestamp field to be present and configured as a date with a specific set of parameters. The index-wide setting of ignore_malformed can cause problems here if it is set to true, because it needs to be false for the @timestamp field. This commit detects if a set of mappings is configured for a datastream by checking for the presence of a DataStreamTimestampFieldMapper metadata field, and passes that information on during Mapper construction as part of the MapperBuilderContext. DateFieldMapper.Builder now checks to see if it is specifically for a data stream timestamp field, and if it is, sets ignore_malformed to false. Relates to #96051
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Data Management/Data streams Data streams and their lifecycles >enhancement Team:Data Management Meta label for data/management team v8.9.0

4 participants