Can multi-fields be used to overcome index.mapping.total_fields.limit?

Elastic Stack Elasticsearch
1

Hi,

We're storing into ES documents that contain an event field that is a JSON object that can have a free-form structure, e.g. a document might have a JSON object which contains a name field, while another json might contain an "age" field. In time, the number of fields in the event field might be bigger than index.mapping.total_fields.limit . In order to overcome this problem we thought that we could store the event as string and map it as a multi-field:

"event": {
      "type": "text",
      "fields": {
        "raw": { 
          "type":  "keyword"
        }
      }

Would this help us get rid of the limitation imposed by the index.mapping.total_fields.limit or the problem would continue to appear due to the event.raw field?

Thanks,
Cristi

2

Multi-fields are just syntactic sugar for prefixing regular fields. E.g. that mapping is effectively equivalent to this mapping internally:

"event": {
  "type": "text"
},
"event.raw": {
  "type": "keyword"
}

E.g. the fields syntax basically creates another field internally, which Elasticsearch knows how to use with the various fields syntax.

So it won't let you bypass the total_fields.limit setting.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.