Index mapping for objects of variable depths

[afrozl]

How would I go about indexing a document that contain objects of variable depth such as:

{ fields: {
args: {
0: 'one',
1: 'two',
2: 'three'
}
)
}
or
{ fields: {
args: {
0: 'one',
1: 'two',
2: { 'param': 'three' }
}
)
}

The situation I have is that if the first type of document gets processed first, the field 'fields.args.2' gets set to text and then the next document doesn't get indexed. Is there a away to handle this or am I missing something?

[Christian_Dahlqvist]

Each field in an index must have the same mapping across all documents, so having a field be mapped as a string as well as an object is not allowed. If you want these documents in the same index, I believe you will need to alter the structure of the data, e.g. by renaming field based on the type it holds.

[afrozl]

Thats what I figured. I guess that's why most people insert logstash in the pipeline when ingesting log data

[afrozl]

I ended up flattening the field and that works fine for my pupose - ie I can still query by individual attributes of nested objects.

The document now looks like:

{ fields: {
args: {
0: 'one',
1: 'two',
'2/param': 'three'
}
)
}