Elasticsearch - Object or Array Datatype

(Nachiket) #1


I am parsing proxy logs. These contain around 3 IP address fields. I wish to create a structure, in which IP is the main field with multiple sub-fields present.

The final structure would be similar to something like this:

      "device": "bluecoat",
      "category": "basic internet"
       "IP": { 
          "device": "",
          "source":  ""
          "destination": ""

What I want to understand is, which is the most effective way of achieving this in elasticsearch? The data is going to exponentially increase and if I have to query IP to find if x.x.x.x is present, which would be the most effective way of achieving this?


(Nachiket) #2

This is so obvious! I almost missed the fact that what I wish to achieve is the Nested DataType.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.