Elasticsearch display number value as string - elasticsearch

Question

I found bellow data in elasticsearch that confused me :
{
"_index": "statsd-2015.09.24",
"_type": "counter",
"_id": "AU__eqbL4jN5fst_IEyK",
"_score": 1,
"_source": {
"ns": "statsd",
"grp": "bad_lines_seen",
"tgt": "",
"act": "",
"val": 0,
"#timestamp": 1443072093000
}
},
{
"_index": "statsd-2015.09.24",
"_type": "counter",
"_id": "AU__fKQM4jN5fst_IEy_",
"_score": 1,
"_source": {
"ns": "statsd",
"grp": "bad_lines_seen",
"tgt": "",
"act": "",
"val": "0",
"#timestamp": "1443072852000"
}
}
Why the field val and timestamp are displayed in different formats?
In first document , they are numbers
In second document, they are strings
They are in the same index and type whose mapping is :
{
"statsd-2015.09.24": {
"mappings": {
"counter": {
"properties": {
"#timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"act": {
"type": "string",
"index": "not_analyzed"
},
"grp": {
"type": "string",
"index": "not_analyzed"
},
"ns": {
"type": "string",
"index": "not_analyzed"
},
"tgt": {
"type": "string",
"index": "not_analyzed"
},
"val": {
"type": "long"
}
}
}
}
}
}
How is this possible ?

Answer 1

You have found differences between field types in the source of the documents. The _source is the original JSON submitted to ElasticSearch to index a document.
However, it isn't what is actually indexed : this is just stored for other purposes (more information can be found in the documentation).
In your case, the val is mapped as a long field, so the string value provided in the second document is in fact parsed to its long value.
You can check this easily : try to index a document like this
{
"ns": "statsd",
"grp": "bad_lines_seen",
"tgt": "",
"act": "",
"val": "abc",
"#timestamp": "1443072852000"
}
You'll have the following parsing error :
MapperParsingException[failed to parse [val]]; nested: NumberFormatException[For input string: \"abc\"];
So, to answer your question : your values' types are different, but in fact the values are both indexed as long due to parsing.

Answer 2

For additional information:
output : {"#timestamp": "2019-03-21T10:52:35.435Z"}
Index mapping: "#timestamp": {"type": "date"}
output : {"#timestamp": 1443072852000}
Index Mapping: "#timestamp": {"type": "date","format": "epoch_millis"}