How to push nested documents with filebeat to a dynamically create index

Elastic Stack Elasticsearch
1

Hi,

I create nested json documents.
I manage to push them with filebeat to get the mapping done dynamicaly.
There was some arrays of objects.
Then reindexed them in new index with the mapping changed for those arrays of objects to nested.

I managed to do nested requests and aggregations so all is fine :slight_smile:

Unfortunatly, when a new index is created automatically the next day by filebeat, the mapping is not nested for new documents but back to arrays of objects. And I have to reindex to get them nested.

I can see that the index pattern shows the nested fields as aggregatable and searchable but I think it's an artefact of the dynamic mapping.

So how to push the new documents with filebeat in new index to get nested mapping done correctly without having to reindex?

And how to remove fields in the index pattern after reindexing arrays of object to nested object?

2

Using a template and disabling dynamic mapping did the trick.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.