Force an object type into a text field?

Elastic Stack Elasticsearch
1

I have a problem. We store http requests in elastic, and it turns out we are using the same parameter name in two different requests with different types.

Request A is sending a parameter named "operation" as a JSON object
Request B is sending a parameter named "operation" as a string

If I set the "operation" field to type=text then request A fails to insert into elastic.
If I set the "operation" field to an object then its B the one that fails.

Is there any way I can get both inserted into elastic? I don't need to search for that field, and I don't really care about the type. All I want is that information stored into elastic in some way.
Is it possible?

Thanks!

2

Might choosing to not index the field at all perhaps be an option?

3

I have tried "index": false on that field, but still get an error.

It also seems that "ignore_malformed" is not an option for "text" fields, which is weird cause a text field can fail too: Can't get text on a START_OBJECT at 1:541

4

Something like this may work:

PUT my_index 
{
  "mappings": {
    "doc": { 
      "properties": { 
        "name": { "type": "keyword"  }, 
        "operation": { 
          "enabled": false,
          "type": "object"
        }
      }
    }
  }
}

PUT my_index/doc/1
{
    "name" : "Tom",
    "operation" : {
      "message" : "trying out Elasticsearch"
    }
}

PUT my_index/doc/2
{
    "name" : "Jerry",
    "operation" : "trying out Elasticsearch"
}

GET my_index/_search
{
  "query": {
    "match_all": {}
  }
}
2 Likes
5

Thank you @Christian_Dahlqvist at least now both requests are indexed, instead of just one of them :smiley:

But I don't understand how it works haha. Following your example, the doc/1 is inserted but without the operation field.
The doc/2 is inserted and I can see the operation field in kibana.

I expected it to work just the opposite, I mean, if the mapping says operation is type=object, why am I only seeing the string one?

It works, and it is perfect, I would just love to understand why is it working like this.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.