How are strings mapped?

[Tony_Chirillo]

In ES 6.2.2, how are string mapped by default? Are they still mapped as both as both text and keyword by default, or did that change?

[Evesy (Michael Eves)]

If a string field does not have an explicit mapping in 6.x it'll be mapped by default to both, as per below:

"type" "text",
"fields": {
  "keyword": {
    "type": "keyword",
    "ignore_above": 256
  }
}

[Tony_Chirillo]

Ok Thanks! Do you have much experience with templates? I think I have a template that might be overriding the default settings and only setting the value to one. I'll post it. If you have time, could you let me know if you possible see the mistake? We pulled the template from the web, it is not home grown. As you can tell, I am still working on trying to understand all the different relationships between things. Thanks for the reply.

{
"template_exchange": {
"order": 1,
"index_patterns": [
"exchange-"
],
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "10000"
}
},
"refresh_interval": "5s"
}
},
"mappings": {
"exchange": {
"dynamic_templates": [
{
"fields": {
"mapping": {
"type": "keyword"
},
"match_mapping_type": "string",
"path_match": "fields."
}
},
{
"strings_as_keyword": {
"mapping": {
"ignore_above": 1024,
"type": "keyword"
},
"match_mapping_type": "string"
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"geoip": {
"dynamic": true,
"type": "object",
"properties": {
"location": {
"type": "geo_point"
}
}
},
"fields": {
"type": "object"
},
"offset": {
"type": "long"
},
"message": {
"norms": false,
"type": "text"
},
"beat": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
},
"hostname": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
},
"version": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"tags": {
"type": "keyword",
"ignore_above": 1024
},
"error": {
"properties": {
"message": {
"type": "text",
"norms": false
},
"code": {
"type": "long"
},
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"source": {
"type": "keyword",
"ignore_above": 1024
},
"prospector": {
"properties": {
"type": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"read_timestamp": {
"type": "keyword",
"ignore_above": 1024
}
},
"_meta": {
"version": "6.1.1"
},
"date_detection": false
}
},
"aliases": {}
}
}

[Evesy (Michael Eves)]

I've had a quick glance -- Anything in the properties block is explicitly mapped, i.e. offset will always by type long.

The config in the dynamic_templates array is more of interest. You have two dynamic mappings, both of which are setting (Unless explicitly mapped elsewhere) anything that Elasticsearch determines to be a string (Due to this bit: match_mapping_type": "string") as a keyword.

The difference is the first object is only matching Elasticsearch fields that begin fields. (Due to: "path_match": "fields."). If the field begins with that, it's mapped as a keyword. If not, it'll be caught by the second object that will also map as a keyword but with "ignore_above": 1024 (i.e. if the field has more than this many characters don't index it.).

I'm not too familiar with path_match, I'd expect to see a wildcard after the period. Either way though, all string fields using this template will be mapped as keywords, rather than both text & keyword.

What's the behaviour you're after?

Cheers,
Mike