Doesn't a field support multiple types?

org.Elasticsearch.index.mapper.MapperParsingException: object mapping for [http.request.body.original] tried to parse field [original] as object, but found a concrete value

I plan to convert the http.request.body.original field generated by apm to the object type, but es prompts it to be a concrete value. Sometimes the original is a json, and sometimes it is a string of ordinary strings (such as xxxxyyyy122 ).

I need to parse it out when original is json type, How to configure mapping in this case?

In addition, I added the Dynamic option to originl, but it didn’t work either

No, a field doesn't support multiple types.

You might be better off setting this as a keyword?

Are there any benefits to using keyword?

You won't run into this problem :slight_smile:

I added mapping for json to this field, but apm returns as "[REDACTED]" by default, which destroys the mapping and es will not write this data. Is there any way to filter out "[REDACTED]"?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.