How to map such object fields

Elastic Stack Elasticsearch
1

How to map such fields?

file.encoding = UTF-8
file.encoding.pkg = sun.io
file.separator = /

Thanks
Sharon.

2

Depends on what you want to do but I'd probably use keyword data type

3

In order to index those fields you will need to either rename or alter the structure. Dots in field names are special and will be expanded, which will cause a mapping conflict for file.encoding as this can not at the same time be a string and an object (as it has a sub-field named pkg).

4

So, if the origin fields are:

file.encoding = UTF-8
file.encoding.pkg = sun.io

and I want to change it to:

file.encoding.type = UTF-8
file.encoding.pkg = sun.io

Which filters should I use?

I assume in this point, I will be able to create object mapping to file.encoding

Thanks
Sharon.

5

I am not sure I understand your question. Could you please clarify with an example document?

6

Is this the syntax to rename it?

mutate {  rename  => { "file.encoding" => "file.encoding.filetype" }  }

Thanks
Sharon

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.