Doesn't a field support multiple types?

Elastic Stack Elasticsearch
1

org.elasticsearch.index.mapper.MapperParsingException: object mapping for [http.request.body.original] tried to parse field [original] as object, but found a concrete value

I plan to convert the http.request.body.original field generated by apm to the object type, but es prompts it to be a concrete value. Sometimes the original is a json, and sometimes it is a string of ordinary strings (such as xxxxyyyy122 ).

I need to parse it out when original is json type, How to configure mapping in this case?

In addition, I added the Dynamic option to originl, but it didn’t work either

2

No, a field doesn't support multiple types.

You might be better off setting this as a keyword?

3

Are there any benefits to using keyword?

4

You won't run into this problem :slight_smile:

5

image
image580×649 14.2 KB

I added mapping for json to this field, but apm returns as "[REDACTED]" by default, which destroys the mapping and es will not write this data. Is there any way to filter out "[REDACTED]"?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.