Better way to remove nested objects to simplify the index

Elastic Stack Elasticsearch
1

Hey there!

I have some performance problems with a relatively small index (20,576,135 docs). I believe that the issue is due to the way we defined the mapping.

Here is the mapping:


          properties:
            internal_id:
              type: text
              fields:
                keyword:
                  type: keyword
            source:
              type: text
              fields:
                keyword:
                  type: keyword
            last_update_date:
                  type: date
            combined_sources_info:
              properties:
                car_id:
                  type: text
                types:
                  properties:
                    name:
                      type: text
                      fields:
                        keyword:
                          type: keyword
                    year_from:
                      type: integer
                    year_to:
                      type: integer
                    source:
                      type: text
            reported_info:
              type: nested
              properties: 
                id:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
                model:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                colour:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                name:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                date_from:
                  type: date
                date_to:
                  type: date
            registry_info:
              type: nested
              properties:
                id:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
                model:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                colour:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                name:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                length:
                  type: long
                tonnage:
                  type: long
                date_from:
                  type: date
                date_to:
                  type: date
                record_id:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
            registry_owners:
              type: nested
              properties: 
                record_id:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
                name:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
                country:
                  type: text
                  fields:
                    keyword:
                      type: keyword
                      ignore_above: 256
                owner_from:
                  type: date
                owner_to:
                  type: date

(Nested objects are arrays)

As you can see, one record or object is a mix of different properties that are nested objects (arrays). Sometimes, the queries take more than 2-3 seconds, and that’s too much. I think the best option is to remove the nested objects, but I am not sure what the best way to do it is. Should we split the index into 2-3 indices, create an alias and later (searching time) aggregate the results or something else? I don’t know.

Could you help me?

Thank you in advance.