Dynamic template override for multi-fields

Elastic Stack Elasticsearch
1

Hi,

I'm using the default logstash index template which defines all string types to be indexed as text and have a multi-field called keyword to be indexed as a keyword data type:

"string_fields": {
	"mapping": {
		"norms": false,
		"type": "text",
		"fields": {
			"keyword": {
			    "type": "keyword"
			}
		}
	},
	"match_mapping_type": "string",
    "match": "*"
}

I then want to define a custom index template for specific types, where I want string types to be mapped as keyword fields, so I have added this in my index template:

"string_fields": {
	"mapping": {
		"type": "keyword"
	},
	"match_mapping_type": "string",
	"match": "*"
}

The merged output (when asking for the index template) then looks like:

"string_fields": {
	"match": "*",
	"match_mapping_type": "string",
	"mapping": {
		"fields": {
			"keyword": {
				"type": "keyword"
			}
		},
		"norms": false,
		"type": "keyword"
	}
}

As you can see, my fields now are of type keyword but also have a multi-field of the same type. This makes sense based on the documentation which states that the merging is "deep", but it's not a desired outcome.

Is there any way to (on my override template) remove the keyword multi-field?

Thanks you in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.