Force an object type into a text field?

I have a problem. We store http requests in elastic, and it turns out we are using the same parameter name in two different requests with different types.

Request A is sending a parameter named "operation" as a JSON object
Request B is sending a parameter named "operation" as a string

If I set the "operation" field to type=text then request A fails to insert into elastic.
If I set the "operation" field to an object then its B the one that fails.

Is there any way I can get both inserted into elastic? I don't need to search for that field, and I don't really care about the type. All I want is that information stored into elastic in some way.
Is it possible?


Might choosing to not index the field at all perhaps be an option?

I have tried "index": false on that field, but still get an error.

It also seems that "ignore_malformed" is not an option for "text" fields, which is weird cause a text field can fail too: Can't get text on a START_OBJECT at 1:541

Something like this may work:

PUT my_index 
  "mappings": {
    "doc": { 
      "properties": { 
        "name": { "type": "keyword"  }, 
        "operation": { 
          "enabled": false,
          "type": "object"

PUT my_index/doc/1
    "name" : "Tom",
    "operation" : {
      "message" : "trying out Elasticsearch"

PUT my_index/doc/2
    "name" : "Jerry",
    "operation" : "trying out Elasticsearch"

GET my_index/_search
  "query": {
    "match_all": {}

Thank you @Christian_Dahlqvist at least now both requests are indexed, instead of just one of them :smiley:

But I don't understand how it works haha. Following your example, the doc/1 is inserted but without the operation field.
The doc/2 is inserted and I can see the operation field in kibana.

I expected it to work just the opposite, I mean, if the mapping says operation is type=object, why am I only seeing the string one?

It works, and it is perfect, I would just love to understand why is it working like this.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.