Conflicting types warning when consuming `metricbeat-*` indices data

[michaelhyatt]

Few of the fields in the standard metricbeat mapping cause eland to display the following warning:

/usr/local/lib/python3.7/dist-packages/eland/field_mappings.py:324: UserWarning: Field kubernetes.system.cpu.usage.nanocores has conflicting types ('double', None) != long
  UserWarning,

The code:

import eland as ed
from elasticsearch import Elasticsearch

es = Elasticsearch(
    hosts="https://xyz:9243",
    basic_auth=("aaa", "bbb")
    )

df = ed.DataFrame(es, es_index_pattern="metricbeat-*")

[sethmlarson]

Thanks for reporting this. I'm wondering if the field being mentioned was added recently and so some indices have the field and some don't? Could you post the mappings for the earliest metricbeat-* index and the latest one too?

[michaelhyatt]

Good point, I think this is what is going on here. The earliest index is metricbeat-7.10.0-2021.03.10-000105

The mapping is attached. mapping.json.zip