Elasticsearch - Object or Array Datatype


(Nachiket) #1

Hi,

I am parsing proxy logs. These contain around 3 IP address fields. I wish to create a structure, in which IP is the main field with multiple sub-fields present.

The final structure would be similar to something like this:

logs/proxy/1
    { 
      "device": "bluecoat",
      "category": "basic internet"
       "IP": { 
          "device": "10.0.0.1",
          "source":  "10.4.4.1"
          "destination": "104.49.44.1"
        }     
    }

What I want to understand is, which is the most effective way of achieving this in elasticsearch? The data is going to exponentially increase and if I have to query IP to find if x.x.x.x is present, which would be the most effective way of achieving this?

https://www.elastic.co/guide/en/elasticsearch/reference/current/array.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/object.html


(Nachiket) #2

This is so obvious! I almost missed the fact that what I wish to achieve is the Nested DataType.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.