ES marking some fields as multi-field by default. Why?

[deepak643 (Deepak)]

I have a document with few fields. For some of the fields in that document, my ES mappings defined those fields as "keyword".

I have indexed one document and tried to retrieve the index mappings to see how ES is storing the rest of the fields. I have seen, some of the other fields which I dint define as "keyword" are also marked as "keyword". I dont understand why.

Examples:

1. Field marked as keyword by ES

"XXX": {
    "type": "keyword"
}

2. Field "YYY" marked as "text" and also mentioned type "keyword" in document as below. Why does ES stores this way for this field? What is the reason behind storing YYY as multi-field. How to avoid it from storing it as multi-field.

"YYY": {
    "type": "text",
    "fields": {
        "keyword": {
            "type": "keyword",
             "ignore_above": 256
         }
     }
}

I am looking forward to understand what are the reasons behind ES storing this way. Please help me understand.

[deepak643 (Deepak)]

I had a mappings in ES in production and we have come up with few fields to be marked as keyword. For eg., if there are 10 fields, 5 fields needs to be used for aggregations purpose and marking them as Keyword would solve the purpose.

With above 5 fields marked as keywords and rest of 5 fields left as is as default. But when fetched mappings from production, we saw all 10 fields are marked as keyword but not just 5.

My question above was to understand this. Now I have got a clarification that, from ES v5 every string field is by default taken as "text and "keyword" as mentioned above. I had found the idea of "dynamic_template" to avoid the rest of the fields going as keyword which easily taking the field limit [1000] capacity.

for eg:
XXX - takes 1 field capacity.
YYY - takes 2 fields capacity. [with dynamic_template, I made the capacity as '1']