Full-text search in the Rollup index

Greetings!
I've configured roll-up jobs for my Elasticsearch cluster. As I see from docs, roll-up index by default contains fields with types keyword or numeric.
I want to perform full-text search by certain fields in my roll-up index. What solution will be best for my case?

  1. Manually insert same fields with the text type.
  2. Do not use roll-up index, perform full-text search on the source ES index. (I wouldn't prefer that case because source index is quite big, and I should store data for 1.5 years for search)

Thank you

What sort of text do you want to add/keep in the rollup?

It will be duplicated values of existing fields with keyword type.

For example, my mapping could be like this:

{ "request.query.terms.keyword": "Foo Bar", "type": "keyword" }
{ "request.query.terms.text": "Foo Bar", "type": "text" } 

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.