Don't index but search JSON Fields

Elastic Stack Elasticsearch
1

Hello!

I'm really sorry if this is a noob question, but in my research I didn't find any solution to my problem.

My ELK-Stack gets a lot JSON formed Activity Stream like data (xAPI). Sadly, they are sometimes very huge and have a special field called "extension" where arbitrary data can be included (object, number, string, more deep nested JSON objects).

This "arbitrary" data is very interesting for my own analytics. Is there a way to insert those JSON Log strings and search for data?

Please done hesitate to ask for further information if I've missed something!

Many Thanks in advance!

1 Like
2

Hello,

I think I will solve my problem with ignore_malformed: true in my mapping.
This just leads to other Problems for me. It's another topic so I will open a new one!