Mapper for [@timestamp] conflicts with existing mapper

[Lelik13a]

I created issues and duplicate here for discussion.

$ elastalert-create-index 
Elastic Version: 7.14.0
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Traceback (most recent call last):
  File "/opt/elastalert2/bin/elastalert-create-index", line 8, in <module>
    sys.exit(main())
  File "/opt/elastalert2/lib/python3.9/site-packages/elastalert/create_index.py", line 273, in main
    create_index_mappings(es_client=es, ea_index=index, recreate=args.recreate, old_ea_index=old_index)
  File "/opt/elastalert2/lib/python3.9/site-packages/elastalert/create_index.py", line 63, in create_index_mappings
    es_client.indices.put_mapping(index=ea_index, doc_type='_doc',
  File "/opt/elastalert2/lib/python3.9/site-packages/elasticsearch/client/utils.py", line 84, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/opt/elastalert2/lib/python3.9/site-packages/elasticsearch/client/indices.py", line 320, in put_mapping
    return self.transport.perform_request(
  File "/opt/elastalert2/lib/python3.9/site-packages/elasticsearch/transport.py", line 318, in perform_request
    status, headers_response, data = connection.perform_request(method, url, params, body, headers=headers, ignore=ignore, timeout=timeout)
  File "/opt/elastalert2/lib/python3.9/site-packages/elasticsearch/connection/http_requests.py", line 91, in perform_request
    self._raise_error(response.status_code, raw_data)
  File "/opt/elastalert2/lib/python3.9/site-packages/elasticsearch/connection/base.py", line 131, in _raise_error
    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)
elasticsearch.exceptions.RequestError: RequestError(400, 'illegal_argument_exception', 'Mapper for [@timestamp] conflicts with existing mapper:\n\tCannot update parameter [format] from [strict_date_optional_time||epoch_millis] to [dateOptionalTime]')

Fixed index mappings like this:

    "@timestamp": {
      "type": "date"
    }

deleted options:

      "format": "dateOptionalTime"

And index created successfully.

[nsano-rururu]

I ran it with the latest elastalert 2.2.1, elasticsearch 7.14, but I couldn't reproduce it. How can I reproduce it?
Would you please provide the elastalert or elasticsearch settings?

[nsano-rururu]

@Lelik13a

Does the document contain a @timestamp field?

[Lelik13a]

Elasticsearch:

Name        : elasticsearch
Arch        : x86_64
Version     : 7.14.0

Installed latest elastalert in virtualenv with python 3.9:

elastalert2        2.2.1
elasticsearch      7.0.0

Edit config, like:

...
writeback_index: elastalert2

And run:

elastalert-create-index --config ./config/elastalert.yaml

[Lelik13a]

The rest of the date fields also need to be corrected, such a:

    "@timestamp": {
      "type": "date"
    },
    "alert_time": {
      "type": "date"
    },
    "match_time": {
      "type": "date"
    },

end etc.

[nsano-rururu]

I tried with other information without changing the value of the last information, but no error occurred.

[nsano-rururu]

Since it cannot be reproduced, we will not investigate further.