Add multiple path_match in dynamic templates

Elastic Stack Elasticsearch
1

Hi,

I use dynamic mapping with some dynamic templates that I customized
I'm trying to block the adding of new fields from type object by default, along with whitelisting some specific object fields.

Here is the mapping I've created.

{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "exclude_unspported_fields_name": {
            "match_pattern": "regex",
            "mapping": {
              "type": "object",
              "enabled": false
            },
            "match_mapping_type": "*",
            "match": "^[^a-zA-Z@_].*"
          }
        },
        {
          "message_field": {
            "path_match": "message",
            "mapping": {
              "norms": false,
              "type": "text"
            },
            "match_mapping_type": "string"
          }
        },
        {
          "string_fields": {
            "mapping": {
              "norms": false,
              "type": "text",
              "fields": {
                "keyword": {
                  "ignore_above": 256,
                  "type": "keyword"
                }
              }
            },
            "match_mapping_type": "string",
            "match": "*"
          }
        },
        {
          "kubernetes_field": {
            "mapping": {
              "dynamic": true
            },
            "path_match": "kubernetes*"
          }
        },
        {
          "beats_field": {
            "mapping": {
              "dynamic": true
            },
            "path_match": "beat*"
          }
        },
        {
          "log_field": {
            "mapping": {
              "dynamic": true
            },
            "path_match": "log*"
          }
        },
        {
      "exclude_object_fields": {
        "mapping": {
          "dynamic": false
        },
        "match_mapping_type": "object",
        "match": "*"
      }
    }
  ],
  "properties": {
    "@timestamp": {
      "type": "date"
    },
    "geoip": {
      "dynamic": true,
      "properties": {
        "ip": {
          "type": "ip"
        },
        "latitude": {
          "type": "half_float"
        },
        "location": {
          "type": "geo_point"
        },
        "longitude": {
          "type": "half_float"
        }
      }
    },
    "@version": {
      "type": "keyword"
    }
  }
}

In the exclude_object_fields section, I disable the dynamic adding of new object fields.
Just before that, I configured kubernetes_field, beats_field, log_field to enable these objects and their subobjects.

My question is, is there a way to specify a multiple path_match within the same dynamic template block? or use it with regex (i.e kubernetes*|beats*|log*) or any other way to simplify the "whitelisted" fields? let's say I need to whitelist 50 fields.

Thanks,

2

Any idea?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.