Hi team. We’re using OpenNMS 30.0.1 with Elasticsearch 7.17.3. We are using Elasticsearch REST integration for events and alarms history, and have noticed that, sometimes, the index created in Elasticsearch might have an incorrect mapping of the date-type fields.

For what we have seen, since timestamps are pushed to Elasticsearch in an epoch format, the resulting index mapping can sometimes be wrongly created with a long field type instead of a date one. This results in a mapping conflict from Elastic point of view, as some fields like @first_event_time or @last_event_time will be treated like long numbers instead of dates. Even worse, this can turn Kibana’s discover function useless, as its histogram won’t be able to be rendered using a non-date field.

We have been able to work around the problem by manually set an index mapping enforcing the date fields. Would there be a way to have OpenNMS enforce this mapping against Elasticsearch? Or perhaps it is already doing it but there’s something else going on with our environment?

I’m attaching the Elastic index mappings before and after enforcing the date type field.