Change field mapping?

Elastic Stack Elasticsearch
1

Hi,
I have a field "fieldA" that was correctly mapped as a string but the source data then changed format from string to a JSON format. Now "fieldA" displays the JSON data as a string which is no good.
As I understand you can't delete a field from an index and then let ES remap the field, right?
So would a change of "_type" to a new value force ES to remap the all fields for that document and solve my problem as I understand mappings is per type?
Or do you experts have any other tricks to solve this? Reindex seems like too much work to be an option.

Thanks
Mathias

2

Hi Mathias,

A field can have a single mapping within an existing index. So your only options would be to either:

  • store data that stores fieldA as a String and data that stores fieldA as an object in different indices
  • map fieldA as {"type": "object", "enabled": false} so that it can accept any json, the pitfall being that such a field will only be stored in the _source but not searchable.
3

Thanks for your reply.
What do they mean by this then?

A type in Elasticsearch represents a class of similar documents. A type consists of a name—such as user or blogpost—and a mapping. The mapping, like a database schema, describes the fields or properties that documents of that type may have, the datatype of each field—such as string, integer, or date—and how those fields should be indexed and stored by Lucene.*

Elasticsearch types are implemented on top of this simple foundation. An index may have several types, each with its own mapping, and documents of any of these types may be stored in the same index.
Because Lucene has no concept of document types, the type name of each document is stored with the document in a metadata field called _type. When we search for documents of a particular type, Elasticsearch simply uses a filter on the _type field to restrict results to documents of that type.

But if the mapping is the same within an index I guess I need to do as you suggest.

Thanks!

Mathias

4

Indeed types have their own mapping, but mappings should be consistent across types. For instance, it's ok for some types to have fields that other types don't have, but it's not ok for different types to have different mappings for the same field.

5

Ah ok,
My problem is not that I need two different mappings for "fieldA" it's more that source data changed for "fieldA" so I need to change mapping. Does it not remap when creating a new index and then get it right? (it's logstash so it creates a new every day)

Br
Mathias

6

I solved my issue by deleting all indexes containing the old mapping of "fieldA" and the reindex them again but with "fieldA" removed.
Thanks for helping me understand!

Br
Mathias