Elasticsearch Field with different types

Question

I try to create an index template for my heterogeneous data. Is there a way to ingest Documents with a field that is sometimes a list of lists:

{
  "xx_response_body": [
    [
      123123,
      ...
    ],
    [
      12312344,
      ...
    ],
    
    ....
  ],
  "Content-Type": "application/json",
  "Vary": "Cookie",
  "x-xss-protection": "1; mode=block"
}

and sometimes an object:

{
  "xx_response_body": {
    "abc": "error",
    "def": "content",
    "hij": {}
  },
  "Content-Type": "application/json",
  "x-xss-protection": "1; mode=block"
}
``

Not possible, a field in an index can have only one type. If your field can be a string or array of string in some documents and a json object in other documents, you will need to choose one type and rename the field with the other type during the ingestion process. — leandrojmp
– leandrojmp, Commented Dec 30, 2021 at 13:37

Evaldas Buinauskas · Accepted Answer · 2022-01-01 12:11:18Z

1

You're better off by creating different fields for these types of fields or storing your data in separate indices, your future self will thank you.

There's also flattened data type that might work, but I've not used that in the past.

Another alternative approach would be storing this information as a string and using runtime fields to extract these fields if you wanted to, but that will always be slower than actually indexing them.

answered Jan 1, 2022 at 12:11

Evaldas Buinauskas

14.2k11 gold badges63 silver badges119 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Elasticsearch Field with different types

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related