ScorpionSting Absent Member.
Absent Member.
1131 views

8.2: cannot be changed from type [long] to [integer]

So, even after going through TID7022736, the elasticsearch plugin is failing with:


[illegal_argument_exception] mapper [hits] cannot be changed from type [long] to [integer]




How can this be resolved?

Visit my Website for links to Cool Solution articles.
0 Likes
8 Replies
AutomaticReply Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

ScorpionSting,

It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.

These forums are peer-to-peer, best effort, volunteer run and that if your issue
is urgent or not getting a response, you might try one of the following options:

- Visit https://www.microfocus.com/support-and-services and search the knowledgebase and/or check
all the other self support options and support programs available.
- Open a service request: https://www.microfocus.com/support
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.microfocus.com)
- You might consider hiring a local partner to assist you.
https://www.partnernetprogram.com/partnerfinder/find.html

Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.microfocus.com/faq.php

Sometimes this automatic posting will alert someone that can respond.

If this is a reply to a duplicate posting or otherwise posted in error, please
ignore and accept our apologies and rest assured we will issue a stern reprimand
to our posting bot.

Good luck!

Your Micro Focus Forums Team
http://forums.microfocus.com



0 Likes
sujithhere Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

Hi,

Can you let us know from which version of Sentinel you are upgrading to 8.2?

This issue happens because in Sentinel 8.2, we have upgraded ES and Kibana and they have changed the type of the field 'hits' to 'integer' from 'long'. So the workaround here is to take a backup of the old kibana index, delete the old kibana index and let the restart of Sentinel create a new Kibana index with the correct mapping. Once the restart of Sentinel server creates a new .kibana index, make sure that you are copying the data from the backup file of old kibana index to this newly create index (so that no data is lost). This should solve this problem of this field getting mapped wrongly to a 'long' data type.

We have tried this in our lab many times and every time this work around works well for us. The error you are getting clearly shows that there is still a reference to the 'long' data type in your mapping which indicates that the clean up of the old index would not have completed properly.

Can you try the below command to confirm the mapping of this field in your current .kibana index? The below command can be run from a command prompt in Sentinel server machine. This will return the entire mapping done in .kibana index.

curl -X GET "localhost:9200/.kibana/?pretty=true"

Once you get the mapping, check out the mapping for the entry 'hits'.
It should be mapped to type integer and not long.

"hits": {
"type": "integer"
}

If this mapping is not shown as 'integer', can you please try repeating the steps mentioned in the TID again? If the result is still the same, please raise a ticket so that we can look in to this issue in detail.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

sujithhere;2484871 wrote:
Hi,

Can you let us know from which version of Sentinel you are upgrading to 8.2?

This issue happens because in Sentinel 8.2, we have upgraded ES and Kibana and they have changed the type of the field 'hits' to 'integer' from 'long'. So the workaround here is to take a backup of the old kibana index, delete the old kibana index and let the restart of Sentinel create a new Kibana index with the correct mapping. Once the restart of Sentinel server creates a new .kibana index, make sure that you are copying the data from the backup file of old kibana index to this newly create index (so that no data is lost). This should solve this problem of this field getting mapped wrongly to a 'long' data type.

We have tried this in our lab many times and every time this work around works well for us. The error you are getting clearly shows that there is still a reference to the 'long' data type in your mapping which indicates that the clean up of the old index would not have completed properly.

Can you try the below command to confirm the mapping of this field in your current .kibana index? The below command can be run from a command prompt in Sentinel server machine. This will return the entire mapping done in .kibana index.

curl -X GET "localhost:9200/.kibana/?pretty=true"

Once you get the mapping, check out the mapping for the entry 'hits'.
It should be mapped to type integer and not long.

"hits": {
"type": "integer"
}

If this mapping is not shown as 'integer', can you please try repeating the steps mentioned in the TID again? If the result is still the same, please raise a ticket so that we can look in to this issue in detail.


Multiple repeats, same result:


xxxx:~ # curl -XGET "localhost:9200/.kibana/?pretty=true"
{
".kibana" : {
"aliases" : { },
"mappings" : {
"config" : {
"properties" : {
"defaultIndex" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"index-pattern" : {
"properties" : {
"timeFieldName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"_default_" : {
"dynamic" : "strict"
},
"visualization" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
},
"visState" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"dashboard" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"hits" : {
"type" : "long"
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"optionsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"panelsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeFrom" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeRestore" : {
"type" : "boolean"
},
"timeTo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1532987751676",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "jUFjHWkTRgeNHiOpmEqrBA",
"version" : {
"created" : "5060399"
},
"provided_name" : ".kibana"
}
}
}
}
xxxx:~ # curl -XPOST "localhost:9200/_reindex" -H 'Content-type: application/json' -d '{"source":{"index":".kibana"},"dest":{"index":".kibana-temp"}}'
{"took":264,"timed_out":false,"total":33,"updated":0,"created":33,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1.0,"throttled_until_millis":0,"failures":[]}
xxxx:~ # rcsentinel stop
Stopping Sentinel...
Stopping the Visual Analytics component...
The Visual Analytics component has stopped.


Stopped Sentinel.
xxxx:~ # rcsentinel startSIdb
Indexing service is running (101292).
Security Intelligence database is started.
Connection between alert store and indexing service is started.
xxxx:~ # curl -XDELETE "localhost:9200/.kibana"
{"acknowledged":true}
xxxx:~ # vi /opt/novell/sentinel/3rdparty/kibana/config/kibana.yml


... "dd" on the following lines ...


pid.file: /home/novell/sentinel/kibana.pid
server.host: 127.0.0.1
kibana.defaultAppId: dashboard/Alert-Dashboard
server.port: 5601
server.basePath: /visual-analytics/proxy
elasticsearch.requestTimeout: 3600000
elasticsearch.url: http://127.0.0.1:9200


...


xxxx:~ # curl -XGET "localhost:9200/.kibana-temp/?pretty=true"
{
".kibana-temp" : {
"aliases" : { },
"mappings" : {
"index-pattern" : {
"properties" : {
"timeFieldName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"config" : {
"properties" : {
"defaultIndex" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"dashboard" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"hits" : {
"type" : "long"
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"optionsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"panelsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeFrom" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeRestore" : {
"type" : "boolean"
},
"timeTo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
}
}
},
"visualization" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
},
"visState" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1532989126808",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "_Ce5KNvvQo2evu5vyDPFpg",
"version" : {
"created" : "5060399"
},
"provided_name" : ".kibana-temp"
}
}
}
}
xxxx:~ # rcsentinel start
Starting Sentinel...
Sentinel is running.
xxxx:~ # curl -XPOST "localhost:9200/_reindex" -H 'Content-type: application/json' -d '{"source":{"index":".kibana-temp"},"dest":{"index":".kibana"}}'
{"took":273,"timed_out":false,"total":33,"updated":0,"created":33,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1.0,"throttled_until_millis":0,"failures":[]}
xxxx:~ # curl -XDELETE "localhost:9200/.kibana-temp"
{"acknowledged":true}
xxxx:~ # curl -XGET "localhost:9200/.kibana/?pretty=true"
{
".kibana" : {
"aliases" : { },
"mappings" : {
"index-pattern" : {
"properties" : {
"timeFieldName" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"config" : {
"properties" : {
"defaultIndex" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"dashboard" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"hits" : {
"type" : "long"
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"optionsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"panelsJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeFrom" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"timeRestore" : {
"type" : "boolean"
},
"timeTo" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
}
}
},
"visualization" : {
"properties" : {
"description" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"kibanaSavedObjectMeta" : {
"properties" : {
"searchSourceJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"uiStateJSON" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
},
"visState" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1532989290049",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "rd9bCLadTuqK_tSkPmF7eg",
"version" : {
"created" : "5060399"
},
"provided_name" : ".kibana"
}
}
}
}
xxxx:~ #

Visit my Website for links to Cool Solution articles.
0 Likes
sujithhere Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

Hi,

The mapping file indicates that your "hits" param still contain the old mapping of 'long'.
Ideally, there are 2 parameters whose data type has been changed from long to integer. They are 'hits' and 'version'.
In the map file you pasted above, both still shows the value as 'long' meaning that has not got updated, in spite of you recreating the index.

Also, one of the most important point here is that your .kibana index before and after sentinel restart is exactly the same.
Ideally, it should have got a new type called 'search' in it when Sentinel creates a new kibana index. That's also missing in your mapping file.
So in this case, even after you are deleting your old index, the exact same .kibana index gets recreated for you. The mapping that we expect
to be generated is not getting created for some reason.
We need to know more about your environment, to understand why this is happening in your set up.

Can you please create an service request so that our support team can take a look at the issue?

Meanwhile, can you please let me know the following,
1. Version of the Elasticsearch in your environment ( curl -XGET 'localhost:9200')?
2. Are you using any ES clustering/stand alone ES server here? If yes, what is the version of ES there? (Run this command, curl -X GET "localhost:9200/_cluster/stats?human&pretty")
3. From which version of Sentinel have you upgraded to 8.2?
4. Is this an appliance set up or a traditional install?

Alternatively, for you to proceed further, you can try the following.

1) Save the kibana index with another name (.kibana-temp)
curl -XPOST "http://localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
"source": {
"index": ".kibana"
},
"dest": {
"index": ".kibana-temp"
}
}'

2) Delete the .kibana index
curl -XDELETE 'localhost:9200/.kibana'

3) Create an index template with proper mapping using the below command,
curl -XPUT "http://localhost:9200/_template/kibana" -H 'Content-Type: application/json' -d'
{
"template": ".kibana",
"settings": {
"number_of_shards": 1
},
"mappings": {
"config": {
"properties": {
"buildNum": {
"type": "keyword"
}
}
},
"index-pattern": {
"properties": {
"fieldFormatMap": {
"type": "text"
},
"fields": {
"type": "text"
},
"intervalName": {
"type": "keyword"
},
"notExpandable": {
"type": "boolean"
},
"sourceFilters": {
"type": "text"
},
"timeFieldName": {
"type": "keyword"
},
"title": {
"type": "text"
}
}
},
"visualization": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"savedSearchId": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
},
"visState": {
"type": "text"
}
}
},
"search": {
"properties": {
"columns": {
"type": "keyword"
},
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"sort": {
"type": "keyword"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"dashboard": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"optionsJSON": {
"type": "text"
},
"panelsJSON": {
"type": "text"
},
"refreshInterval": {
"properties": {
"display": {
"type": "keyword"
},
"pause": {
"type": "boolean"
},
"section": {
"type": "integer"
},
"value": {
"type": "integer"
}
}
},
"timeFrom": {
"type": "keyword"
},
"timeRestore": {
"type": "boolean"
},
"timeTo": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"url": {
"properties": {
"accessCount": {
"type": "long"
},
"accessDate": {
"type": "date"
},
"createDate": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
"server": {
"properties": {
"uuid": {
"type": "keyword"
}
}
},
"timelion-sheet": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"timelion_chart_height": {
"type": "integer"
},
"timelion_columns": {
"type": "integer"
},
"timelion_interval": {
"type": "keyword"
},
"timelion_other_interval": {
"type": "keyword"
},
"timelion_rows": {
"type": "integer"
},
"timelion_sheet": {
"type": "text"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
}
}
}'

4) Transfer the data from the temporary index(.kibana-temp) to the .kibana index,
curl -XPOST "http://localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
"source": {
"index": ".kibana-temp"
},
"dest": {
"index": ".kibana"
}
}'

5) Delete the temporary index
curl -XDELETE 'localhost:9200/.kibana-temp'


You dont need to restart ES after this and should be able to solve this problem of data getting wrongly mapped to the type 'long'.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

sujithhere;2484997 wrote:
Hi,

The mapping file indicates that your "hits" param still contain the old mapping of 'long'.
Ideally, there are 2 parameters whose data type has been changed from long to integer. They are 'hits' and 'version'.
In the map file you pasted above, both still shows the value as 'long' meaning that has not got updated, in spite of you recreating the index.

Also, one of the most important point here is that your .kibana index before and after sentinel restart is exactly the same.
Ideally, it should have got a new type called 'search' in it when Sentinel creates a new kibana index. That's also missing in your mapping file.
So in this case, even after you are deleting your old index, the exact same .kibana index gets recreated for you. The mapping that we expect
to be generated is not getting created for some reason.
We need to know more about your environment, to understand why this is happening in your set up.

Can you please create an service request so that our support team can take a look at the issue?

Meanwhile, can you please let me know the following,
1. Version of the Elasticsearch in your environment ( curl -XGET 'localhost:9200')?
2. Are you using any ES clustering/stand alone ES server here? If yes, what is the version of ES there? (Run this command, curl -X GET "localhost:9200/_cluster/stats?human&pretty")
3. From which version of Sentinel have you upgraded to 8.2?
4. Is this an appliance set up or a traditional install?


Thanks for that...


{
"name" : "Nv2n_en",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "xxxx",
"version" : {
"number" : "5.6.3",
"build_hash" : "1a2f265",
"build_date" : "2017-10-06T20:33:39.012Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}


2. Single Server.
3. I can't remember if I started with a v7 or v8 install, but every minor patch had been applied when they were released.
4. Appliance

Visit my Website for links to Cool Solution articles.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

sujithhere;2484997 wrote:
Alternatively, for you to proceed further, you can try the following.

1) Save the kibana index with another name (.kibana-temp)
curl -XPOST "http://localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
"source": {
"index": ".kibana"
},
"dest": {
"index": ".kibana-temp"
}
}'

2) Delete the .kibana index
curl -XDELETE 'localhost:9200/.kibana'

3) Create an index template with proper mapping using the below command,
curl -XPUT "http://localhost:9200/_template/kibana" -H 'Content-Type: application/json' -d'
{
"template": ".kibana",
"settings": {
"number_of_shards": 1
},
"mappings": {
"config": {
"properties": {
"buildNum": {
"type": "keyword"
}
}
},
"index-pattern": {
"properties": {
"fieldFormatMap": {
"type": "text"
},
"fields": {
"type": "text"
},
"intervalName": {
"type": "keyword"
},
"notExpandable": {
"type": "boolean"
},
"sourceFilters": {
"type": "text"
},
"timeFieldName": {
"type": "keyword"
},
"title": {
"type": "text"
}
}
},
"visualization": {
"properties": {
"description": {
"type": "text"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"savedSearchId": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
},
"visState": {
"type": "text"
}
}
},
"search": {
"properties": {
"columns": {
"type": "keyword"
},
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"sort": {
"type": "keyword"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"dashboard": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"optionsJSON": {
"type": "text"
},
"panelsJSON": {
"type": "text"
},
"refreshInterval": {
"properties": {
"display": {
"type": "keyword"
},
"pause": {
"type": "boolean"
},
"section": {
"type": "integer"
},
"value": {
"type": "integer"
}
}
},
"timeFrom": {
"type": "keyword"
},
"timeRestore": {
"type": "boolean"
},
"timeTo": {
"type": "keyword"
},
"title": {
"type": "text"
},
"uiStateJSON": {
"type": "text"
},
"version": {
"type": "integer"
}
}
},
"url": {
"properties": {
"accessCount": {
"type": "long"
},
"accessDate": {
"type": "date"
},
"createDate": {
"type": "date"
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
"server": {
"properties": {
"uuid": {
"type": "keyword"
}
}
},
"timelion-sheet": {
"properties": {
"description": {
"type": "text"
},
"hits": {
"type": "integer"
},
"kibanaSavedObjectMeta": {
"properties": {
"searchSourceJSON": {
"type": "text"
}
}
},
"timelion_chart_height": {
"type": "integer"
},
"timelion_columns": {
"type": "integer"
},
"timelion_interval": {
"type": "keyword"
},
"timelion_other_interval": {
"type": "keyword"
},
"timelion_rows": {
"type": "integer"
},
"timelion_sheet": {
"type": "text"
},
"title": {
"type": "text"
},
"version": {
"type": "integer"
}
}
}
}
}'

4) Transfer the data from the temporary index(.kibana-temp) to the .kibana index,
curl -XPOST "http://localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
"source": {
"index": ".kibana-temp"
},
"dest": {
"index": ".kibana"
}
}'

5) Delete the temporary index
curl -XDELETE 'localhost:9200/.kibana-temp'


You dont need to restart ES after this and should be able to solve this problem of data getting wrongly mapped to the type 'long'.


This process worked...thanks....


Visit my Website for links to Cool Solution articles.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

ScorpionSting;2485053 wrote:
This process worked...thanks....



Only problem now is that the default visualisations (alerts, IP flow, etc) weren't created....visualisations is blank

Visit my Website for links to Cool Solution articles.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: 8.2: cannot be changed from type [long] to [integer]

ScorpionSting;2485059 wrote:
Only problem now is that the default visualisations (alerts, IP flow, etc) weren't created....visualisations is blank


Re-running the TID resolved this particular issue


Visit my Website for links to Cool Solution articles.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.