How to map 2 level object field in elastic search?

Elastic Stack Elasticsearch
1

I have to index the below document in elastic search and need suggestion for the mapping template.

{
	"system": {
		"filler2": "",
		"INIT_LOOKUP_TM": "2019-05-21T14:34:49.648Z"
	},
	"pmx": {
		"coeKey": {
			"a": "ISG",
			"b": null,
			"c": "20180720164659068000",
			"d": "8A78D08FDB3127BB05F408",
			"e": "6PK3SMOgTPi6Y0mPBTNMBA=="
		},
		"Response": {
			
			"f": " way",
			"g": "60",
			"h": "fa65b61a342dfc511c42"
		},
		"content": {
			"device": "20180720160",
			"system": "5",
			"page": "MOBILESIGNIN",
			"SessionId": ""
		}
	}
}

the object named "system" will always havve the 2 fields in it and it is fixed.
the "pmx" object field can vary and it can be null aslo on some documents. I need to access fields like a,b etc in future and need to make aggregations.

{
    "order": 0,
    "index_patterns": [
      "*system_model*"
    ],
    "settings": {
      "index": {
        "number_of_shards": "6",
        "number_of_replicas": "1"
      }
    },
    "mappings": {
      "_doc": {
        "dynamic_templates": [
          {
            "string_fields": {
              "match": "*",
              "match_mapping_type": "string",
              "mapping": {
                "type": "keyword"
              }
            }
          },
          {
            
            "tmx_datefields": {
              "path_match": "pmx.Response.*",
			  
              "match_mapping_type": "date",
              "mapping": {
                "type": "keyword"
              }
            }
            
          }
		  
        ],
        "properties": {
          "system": {
 					"properties": {


 						

 					}
 				},
				"pmx": {
            
						"type": "object"
						}
		  
        }
      }
    },
    "aliases": {
	"pmx_system":{}
	
	}
  }

what could be the best mapping type for the field pmx. should I define inner objects seperately or should I try nested object mapping?

thanks for reading and helping.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.