Issue when indexing booleans to elastic

When indexing, Elasticsearch, by default, won't touch the source document. It will try to parse the value of a field to index it but the value won't be changed (except if using an ingest pipeline). For instance, if a document contains a field "field": "true" is indexed without an ingest pipeline then it will stay stored like that despite the fact "field" is mapped as boolean.

The only solution to that is explicitly converting it by using logstash or an ingest pipeline.

1 Like