Best way to manage unbounded XML fields

Hi guys,
I'm wondering what's the best implementation of an index which stores XML data, written and processed by logstash, with unbounded elements.
Here is a simple example schema:

<xs:complexType name="root">
<xs:element name="header_element" type="header_element_type" />
<xs:element name="body_element" type="body_element_type" maxOccurs="unbounded" />
<xs:complexType name="header_element_type">
<xs:element name="trx_data" type="string" />
<xs:element name="name" type="string" />
<xs:complexType name="body_element_type">
<xs:element name="general_data" type="string" />
<xs:element name="school_data" type="integer" />
</xs:complexType> Blockquote

The first idea was using an index template as best practise, but then I was told that body_element can occurs many times :frowning:
What I would like to do is to avoid writting data of a single XML payload in multiple docs (n per n body + 1 per header and using an id field to relate them) because I suspect this will stress too much ES when doing data analytics.

Any idea or suggestion will be extremely appreciated.
Thank you guys!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.