Indexed document has an unknown field

Hi, I've made an index using dynamic mapping. The document that I've used when creating it looks like this;

{
  "graph":{
    "id":601,
    "name":"Graph",
    "labels":[
      {
        "user":"*B",
        "id":16,
        "colour":"157AFF",
        "value":9
      },
      {
        "user":"A",
        "id":534,
        "colour":"EEAF1B",
        "value":0
      },
      {
        "user":"J",
        "id":1954326,
        "colour":"C15CB9",
        "value":9
      }
    ]
  }
}

When I check the document in the discover it has all of the label entries under graph.labels and it's an unknown field.

I want to make sure that all of the values inside the label, e.g. user, value etc. Are searchable correctly and that I can use them for creating visualisations.

How can I stop the graph.label from being an unknown type and make sure that I can use all my data for visualisations.

Thanks.

You'll need to define them as fields in the ingest. Otherwise, if they're not analyzable, Kibana cannot create an aggregation on it.

I've created the mapping myself instead of using the dynamic mapping, but am still having some trouble with the labels being recognised in the document. My mapping looks like;

  "mappings" : {
"properties" : {
  "graph" : {
    "properties" : {
      "active" : {
        "type" : "boolean"
      },
      "createdAt" : {
        "type" : "date"
      },
      "createdBy" : {
        "type" : "keyword"
      },
      "description" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "id" : {
        "type" : "keyword"
      },
      "labels" : {
        "type" : "nested",
        "properties" : {
          "colour" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "id" : {
            "type" : "keyword"
          },
          "user" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "value" : {
            "type" : "long"
          }
        }
      },
      "modifiedAt" : {
        "type" : "date"
      },
      "modifiedBy" : {
        "type" : "keyword"
      },
      "name" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "searchableId" : {
        "type" : "keyword"
      },
      "version" : {
        "type" : "keyword"
      }
    }
  }
}

}

As you can see I've tried setting the lable type to nested because there will be an array of objects in there.

Kibana doesn't do aggregations on nested documents. We recommend denormalizing your data in situations like this.