Is it wasteful to configure text as keyword with "fields": keyword?

Elastic Stack Elasticsearch
1

With a mapping below.

   "EventType" : {
      "type" : "keyword",
      "fields" : {
        "keyword" : {
          "type" : "keyword",
          "ignore_above" : 256
        }
      }

The reason why we are doing this is to ensure consistency from our API query.
The query engine does not need to know if the field is a text or keyword.
Whenever we need to query for keyword, we just use "field.keyword", etc.

Is ES indexing the same field twice with exact same result in such _mappings?

2

The 2 fields are serving different purposes;

  • The text field is used for fulltext capabilities
  • The keyword field is used for exact match, sorting, aggregations.
3

I understand.
My intend is to make the field exact match only. But I don't want the query engine to keep a list of which field to query with "xyz" and which to query with "xyz.keyword"; therefore, I unconditionally created a "keyword" field regardless of "text" or "keyword".

With below example. The query engine will performa exact match with either "aaa.keyword" or "bbb.keyword".
If query is "aaa" or "bbb", then it might find partial match with "aaa" but only returns exact match with "bbb", etc.
This simplifies the lucene json payload for query generation.

   "aaa" : {
      "type" : "text",
      "fields" : {
        "keyword" : {
          "type" : "keyword",
          "ignore_above" : 256
        }
      },
   "bbb" : {
      "type" : "keyword",
      "fields" : {
        "keyword" : {
          "type" : "keyword",
          "ignore_above" : 256
        }
      }

But does this cause wasted index space for the field "bbb"? This is my question.
Our cluster has grown very fast, and I'm weighting the pros & cons of everything we do.

4

If aaa just need to be a keyword just do:

"aaa" : {
  "type" : "keyword"
},
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.