Give wildcard for fieldname in emit() when creating Runtime field throws error

Elastic Stack Elasticsearch
1

Hi,

I have a field, say macAddress in all my documents, but with different names. Like in some documents, it is host.macAddress, while in some it is machine.mac and so on.

I want to create a runtime field called macAddress, which will map any field of the form mac to it.

Meaning, now all the docs will have a common macAddress field (same field name).. I can use the same for aggregations.

I tried the below:

PUT _component_template/xx-runtime-mappings
{
  "template": {
    "mappings": {
      "runtime": {
        "macAddress": {
          "type": "long",
          "script": {
            "source": "emit(doc['*mac*'].value)"
          }
        }
      }
    }
  },
  "_meta": {
    "description": "Mapping for macAddress fields"
  }
}

Doesn't through an error when I execute this, but when querying giving fields: [*], throws error:

"caused_by": {
            "type": "illegal_argument_exception",
            "reason": "No field found for [*mac*] in mapping"
          }

Thanks
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.