This field has a type conflict

[DebianGuru]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

20

RAM

18GB

Storage for /

166G

Storage for /nsm

3.4TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I had what looked like [(https://docs.securityonion.net/en/2.4/release-notes.htm)] after my upgrade to 2.4.100. I'm now at 2.4.110 and have what looks like a very similar situation. In kibana > Stack Management > Data views > logs-* I have 3 mapping conflicts.
Name Type
metadata.input.beats.host ipkeyword, ip
recordedfuture.evidence_details flattened, object
version keyword, object

I can click on the !Conflict and see the indices where the conflicts exist. The first one for instance has about a dozen indces where it's a "keyword" and the rest are all "ip"

I did some searchin on the Elastic website concerning rollover and reindexing, but honestly, it doesn't make much sense. I did find out how you can put explicit maping under Stack Management > Index Management > Index Templates, but how you reindex to get your data into the proper mappings, I cannot figure out. The documentation from the elasticseach website is really more for a DIY setup, whereas I don't fully understand how SO rolls this all together and I'm afraid of corrupting somethings.

Thanks in advance for the help.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

We've just updated https://docs.securityonion.net/en/2.4/release-notes.html#known-issues to include more information. Please take a look and let us know whether or not that helps.

[DebianGuru]

I ran those commands without throwing any obvious errors, but it did not change the results. Is there a log I can watch to see if it's failing somewhere?

[weslambert]

Those field conflicts weren't addressed with recent updates, so they will need to be fixed in the future. The conflicts shouldn't impact most users daily use since those fields aren't used in many, if any aggregations or data tables. As long as you aren't experiencing any other issues, you should be fine for now.