Change mapping

Elastic Stack Elasticsearch
1

Hi,

I am really struggling to edit my existing index, in order to exclude certain fields from being searchable.
I've tried so many suggestions that I'm just about to go insane.

My ES index is idx-wsa_access_logs and the field I want to exclude is http_method.

(I'm really new to ES by the way)

I've tried:

PUT idx-wsa_access_logs/_mapping/_doc
{
"properties": {
"http_method": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256,
"enabled": false
}
}
}
}
}

Results in:

{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [fields] has unsupported parameters: [enabled : false]"
}
],
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [fields] has unsupported parameters: [enabled : false]"
},
"status": 400
}

I tried:

PUT idx-wsa_access_logs
{
"mappings": {
"doc": {
"properties": {
"http_method": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"enabled": false,
"ignore_above": 256
}
}
}
}
}
}
}

Results in:
{
"error": {
"root_cause": [
{
"type": "resource_already_exists_exception",
"reason": "index [idx-wsa_access_logs/2yAaQwn2S-uwpZ_CuwPZLA] already exists",
"index_uuid": "2yAaQwn2S-uwpZ_CuwPZLA",
"index": "idx-wsa_access_logs"
}
],
"type": "resource_already_exists_exception",
"reason": "index [idx-wsa_access_logs/2yAaQwn2S-uwpZ_CuwPZLA] already exists",
"index_uuid": "2yAaQwn2S-uwpZ_CuwPZLA",
"index": "idx-wsa_access_logs"
},
"status": 400
}

Please can someone advise what I need to pass in order to achieve my goal?

Thank you!

2

You can't change the mapping of an index that already exists, you need to delete it and recreate the data, or reindex into a new index with the new mapping.

However if you want a field to be stored but not searched, then look at https://www.elastic.co/guide/en/elasticsearch/reference/6.3/mapping-index.html

3

Hi warkolm,

Okay, in that case, I deleted my index and tried the following:

PUT idx-wsa_access_logs
{}

PUT idx-wsa_access_logs/_mapping/doc
{
"properties": {
"http_method": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"enabled": false,
"ignore_above": 256
}
}
}
}
}

but I get:

{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [fields] has unsupported parameters: [enabled : false]"
}
],
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [fields] has unsupported parameters: [enabled : false]"
},
"status": 400
}

Is '[enabled : false]' no longer supported?

Thank you

4

Nope, it just doesn't apply to that field type - https://www.elastic.co/guide/en/elasticsearch/reference/6.3/enabled.html

Did you try setting "index": false?

5

Yes, I tried "index": false but it did not do what I am trying to achieve.

Kibana's 'index pattern creator' shows my field as non-searchable and under the 'discover' area it shows it as an available field on the left.
I don't want ES or Kibana know anything about this field, other than it being in the original message.

How can I do this?

Thank you

6

Instead of

PUT idx-wsa_access_logs/_mapping/doc
{
    "properties": {
        "http_method": {
            "type": "text",
            "fields": {
                "keyword": {
                    "type": "keyword",
                    "enabled": false,
                    "ignore_above": 256
                }
            }
        }
    }
}

simply use

PUT idx-wsa_access_logs/_mapping/doc
{
    "properties": {
        "http_method": {
            "enabled": false
    }
}

As the documentation states:

The enabled setting, which can be applied only to the mapping type and to object fields, causes Elasticsearch to skip parsing of the contents of the field entirely. The JSON can still be retrieved from the _source field, but it is not searchable or stored in any other way

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.