Still struggling with the correct mapping.
I have modified my JSON as:
{
"Date" : "2015-03-21T00:09:00",
"Activities" : [ {
"ActivityName" : "SSH",
"Fields" : [ {
"FieldName" : "User",
"valueCounts" : [ {
"valueName" : "joe",
"valueCount" : 2
}, {
"valueName" : "jack",
"valueCount" : 5
}, {
"valueName" : "jane",
"valueCount" : 10
} ]
}, {
"FieldName" : "DstIP",
"valueCounts" : [ {
"valueName" : "10.1.1.1",
"valueCount" : 2
}, {
"valueName" : "10.2.2.2",
"valueCount" : 5
}, {
"valueName" : "192.168.1.1",
"valueCount" : 10
} ]
} ]
} ]
}
And, I create a mapping as:
curl -XPUT localhost:9200/_template/metrics -d '{
"template" : "metrics",
"order": 2,
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"metric" : {
"properties" : {
"Date" : { "type" : "date"},
"Activities" : {
"properties" : {
"ActivityName": {"type" : "string"},
"Fields" : {
"properties" : {
"FieldName" : {"type":"string"},
"valueCounts" : {
"properties" : {
"valueName" : {"type" : "string"},
"valueCount" : {"type" : "integer"}
}
}
}
}
}
}
}
}
}
}'
curl -XPOST 'http://localhost:9200/metrics/metric' -d '
{"Date":"2015-03-21T00:09:00","Activities":[{"ActivityName":"SSH","Fields":[{"FieldName":"User","valueCounts":[{"valueName":"joe","valueCount":2},{"valueName":"jack","valueCount":5},{"valueName":"jane","valueCount":10}]},{"FieldName":"DstIP","valueCounts":[{"valueName":"10.1.1.1","valueCount":2},{"valueName":"10.2.2.2","valueCount":5},{"valueName":"192.168.1.1","valueCount":10}]}]}]}'
But none of the fields get parsed out 
I have tried explicitly declaring nested types within the mapping but
doesn't change anything.
What am I doing wrong?
Thanks,
Tim
On Friday, April 3, 2015 at 10:59:31 PM UTC-7, sec...@gmail.com wrote:
Thanks for the pointer, Thierry.
On Thursday, April 2, 2015 at 1:26:44 AM UTC-7, Thierry Templier wrote:
Hi,
In fact, you don't need to explicitely specify that a field is a list or
not in the mapping. This is automatically supported by Elasticsearch. See
this link in the documentation for more details:
http://www.elastic.co/guide/en/elasticsearch/reference/1.x/mapping-array-type.html
.
Hope it will help you,
Thierry
2015-04-02 6:46 GMT+02:00 sec...@gmail.com:
Hi,
Noob at Elasticsearch, I am trying to push some nested json to
Elasticsearch and have the nested objects parsed out as facets. If I use
dynamic mapping then elasticsearch does not seem to parse out the internal
objects. I guess I need to define a mapping for my index?
Example:
{
"Date": "2015-03-21T00:09:00",
"Activities": [
{
"ActivityName": "SSH",
"Fields": [
{
"User": [
{
"joe": 2,
"jane": 3,
"jack": 5
}
]
},
{
"DstIP": [
{
"HostA": 3,
"HostB": 5,
"HostC": 6
}
]
}
]
}
]
}
I tried to follow the mapping documentation but failed to come up with a mapping that represents the JSON above. I guess I am not sure how to map lists. If it helps, here's how I create the JSON in Scala using the Jackson library:
scala> nestedMap
res3: scala.collection.immutable.Map[String,Object] = Map(Date -> 2015-03-21T00:09:00, Activities -> List(Map(ActivityName -> SSH, Fields -> List(Map(User -> List(Map(joe -> 2, jane -> 3, jack -> 5))), Map(DstIP -> List(Map(HostA -> 3, HostB -> 5, HostC -> 6)))))))
scala> println(Serialization.write(nestedMap))
{"Date":"2015-03-21T00:09:00","Activities":[{"ActivityName":"SSH","Fields":[{"User":[{"joe":2,"jane":3,"jack":5}]},{"DstIP":[{"HostA":3,"HostB":5,"HostC":6}]}]}]}
Is there a way to get Jackson to spit out the schema that can be directly fed to elasticsearch as a mapping/template?
Thanks.
--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/735251b3-3b00-46d3-bf41-f02efaad3b12%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/735251b3-3b00-46d3-bf41-f02efaad3b12%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.
--
Best,
Thierry
Thierry Templier, Lead Architect
ttem...@restlet.com
Restlet SAS, 6 rue Rose Dieng-Kuntz • 44300 Nantes • France
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/63c0fd6b-10e4-4b62-a2bf-7fd4f277957b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.