Indexed document has an unknown field

[ethranes]

Hi, I've made an index using dynamic mapping. The document that I've used when creating it looks like this;

{
  "graph":{
    "id":601,
    "name":"Graph",
    "labels":[
      {
        "user":"*B",
        "id":16,
        "colour":"157AFF",
        "value":9
      },
      {
        "user":"A",
        "id":534,
        "colour":"EEAF1B",
        "value":0
      },
      {
        "user":"J",
        "id":1954326,
        "colour":"C15CB9",
        "value":9
      }
    ]
  }
}

When I check the document in the discover it has all of the label entries under graph.labels and it's an unknown field.

I want to make sure that all of the values inside the label, e.g. user, value etc. Are searchable correctly and that I can use them for creating visualisations.

How can I stop the graph.label from being an unknown type and make sure that I can use all my data for visualisations.

Thanks.

[Marius_Dragomir]

You'll need to define them as fields in the ingest. Otherwise, if they're not analyzable, Kibana cannot create an aggregation on it.

[ethranes]

I've created the mapping myself instead of using the dynamic mapping, but am still having some trouble with the labels being recognised in the document. My mapping looks like;

  "mappings" : {
"properties" : {
  "graph" : {
    "properties" : {
      "active" : {
        "type" : "boolean"
      },
      "createdAt" : {
        "type" : "date"
      },
      "createdBy" : {
        "type" : "keyword"
      },
      "description" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "id" : {
        "type" : "keyword"
      },
      "labels" : {
        "type" : "nested",
        "properties" : {
          "colour" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "id" : {
            "type" : "keyword"
          },
          "user" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "value" : {
            "type" : "long"
          }
        }
      },
      "modifiedAt" : {
        "type" : "date"
      },
      "modifiedBy" : {
        "type" : "keyword"
      },
      "name" : {
        "type" : "text",
        "fields" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      },
      "searchableId" : {
        "type" : "keyword"
      },
      "version" : {
        "type" : "keyword"
      }
    }
  }
}

}

As you can see I've tried setting the lable type to nested because there will be an array of objects in there.

[Marius_Dragomir]

Kibana doesn't do aggregations on nested documents. We recommend denormalizing your data in situations like this.