Ok let me give you small view of Content which is in json format:
{
"s3.version":"mc5ETuM",
"invokehttp.tx.id":"f75283d92c",
"sqs.receipt.handle":"Zl/yWciVceGIiWiC5sNkQ=",
"Server":"J4)",
"s3.etag":"712a41",
"listEMResponse":"",
"indexed_file_path":"fasfd",
"schemaName":"",
"uuid":"cf",
"sqs.message.id":"ae",
"sqs.SenderId":"AI",
"hash.value":"7b77",
"tableName":"Table1",
"execution.command":"/bin/bash",
"filename":"1554448956907.csv",
"s3.key":"/15544_TB_.csv",
"execution.command.args":".-1"
}
Now the problem is execution.command.args and execution.command both contain data if i make execution.command type as object then on running it will give error what i did is :
PUT index_try
{
"mappings": {
"json": {
"properties": {
"created_at": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
},
"execution": {
"type": "object",
"properties": {
"command": {
"type": "object",
"properties": {
"args": {
"type": "text"
}
}
}
}
}
}
}
},
"settings": {
"number_of_shards": 6,
"number_of_replicas": 1
}
}
I refered following post may be this help you