Please clarify the functional index.mapping.depth.limit.
From the documentation it seems that this option will limit the depth of the lower-level fields created by the dynamic mapping, and so . I need only the first two, I set the value to 2 and suddenly get an error
[WARN] [logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {: status => 400,: action => ["index", {: _id => nil,: _index => "3dash-2018.08.23",: _type => "doc",: _routing => nil}, # <LogStash :: Event: 0x290a2d39>],: response => {"index" => {"_ index" => "3dash-2018.08.23", "_type" => "doc", "_id" => " pDEcZ2UB9niMDQsqsMkQ "," status "=> 400," error "=> {" type "=>" illegal_argument_exception "," reason "=>" Limit of mapping depth [2] in index [3dash-2018.08.23] has exceeded due to object field [Response.OperationSystemList.Data] "}}}}

If I do not use this option correctly, then how do I limit the dynamic mapping to the first two levels?
Thx for answers.

This option will limit the depth of fields, but in a way that rejects documents that have a too deep structure.

It looks like what you are after is to ignore fields that are more than 2 levels deep, which can be done this way with dynamic templates:

PUT test 
  "mappings": {
    "_doc": {
      "dynamic_templates": [
          "deep_objects": {
            "match_mapping_type": "object",
            "path_match": "*.*",
            "mapping": {
              "type": "object",
              "enabled": false

Thank you for the explanation, try to do so.

I correctly understand that if I need a third level, then the difference will be in "path_match": "*. *. *"?

This is correct.

thank you for clarification!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.