Escaping field names in queries

Elastic Stack Elasticsearch
1

We have discovered that some documents in our index contain a source that resembles the following

{
  "a": {
    "b" : ["test1"]
  },
  "a.b" : ["test2"]
}

I'm aware of how to perform queries with "exists", but how do I specify the field 'a.b' and not the field 'a'.'b'

2

What is the mapping?

3

Thanks for responding.

For this

{
  "a": {
    "b" : ["test1"]
  }
}

a is mapped as an object (not nested) with b as keyword

the mistake "a.b" : ["test2"] exists in the source but is not mapped.

4

It's actually mapped the same way. So you can't make the difference I'm afraid.

5

So I can't detect records where this has happened at all?

6

May be with a script query? But unsure.

7

surely thats the same problem though?

How do I tell elastic to treat

doc['a.b'] returning what b contains within the object a

and

doc['a.b'] return what a.b contains

differently?

I assumed there was some way to escape the field name so Elastic didn't treat the '.' as a field break, (hence the title) but you seem to be saying that is not possible.

8

I believe that you can use the _source from a script to get the exact JSON document you actually sent. See Accessing document fields and special variables | Elasticsearch Guide [7.13] | Elastic for more details on that.

That way you could may be implement a script which reads _source.a and if it exists, do something with that...

HTH

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.