Enable .keyword fields for specific fields only

Elastic Stack Elasticsearch
2

I think there is some confusion here, you are mixing up the name of the field with the mapping of the field.

If you do not create a mapping for a field, Elasticsearch will create a mapping for this field when it receives the first document, for string fields it will map the field first as a text field and then it will map the same field again as a keyword field, this is done using multi-fields.

What happens is that, for example, if you have an unmapped field named ExampleField, and let Elasticsearch create the mapping, this is what you will have in the mapping:

        "ExampleField": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }

The parte after fields is the multi-field, what it is doing is mapping the same field on a different way with the suffix keyword.

So you have ExampleField as a text field and Example.keyword as a keyword field.

Since you are explicitly telling Elasticsearch to map fields starting with request.* as keyword, you will not have any field with the suffix .keyword, but all the request.* field will be mapped as keyword field.

1 Like