Hello,
Elasticsearch version: 8.8.2
I have an index template with runtime fields:
"dynamic": "runtime"
When i add a document to index with dotted field (bash.command.test),
its added normally as a runtime field:
"runtime": {
"bash.command.test": {
"type": "keyword"
}
},
I changed the template with lowercase normalizer for case insensitive search:
"dynamic": "runtime",
"dynamic_templates" : [
{
"lowercase_dynamic_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"normalizer" : "lowercase",
"type" : "keyword"
}
}
}
],
When i add a doc to new index, i got an error:
"error": {
"type": "illegal_state_exception",
"reason": "Missing intermediate object bash"
}
Full requests and responses are here
I added this option to /etc/sysconfig/elasticsearch file but the error is still here (according to this doc):
export ES_JAVA_OPTS="-Dmapper.allow_dots_in_name=true"
I can't change the fields names like this: bash_command_test. Because i have too many fields and it depends other applications.
How can i fix this?