Issue with Dynamic Template

[elk_user1]

Hi there,

I am trying to use dynamic templates for mapping any new incoming text fields to multifields with text and keyword. I'm facing two issues here :

1. I'm using regex for matching field name and it doesn't seem to be working as expected
2. ignore_above:256 appears in mapping by default and I don't want that as any values with more than 256 length has also to be considered in our use case.

Below is the mapping which I am currently working on. If I add any new field named abc.xyz.test, which doesn't come under the match criteria, still it is being indexed.

Any help is appreciated. Thanks in advance.

PUT test-dynamic-template
{
    "mappings": {
        "test-type": {     
        	"_all": {
				"enabled": false
			},
             "dynamic_templates": [
                { "allFields": {
                      "match_mapping_type": "*",
                      "match": "abc.xyz.http://test-url.com/extension*", 
                      
                      "mapping": {
                             "type": "text",
									"fields": {
										"keyword": {
											"type": "keyword"
										}
									}
                      }
                }}],
                
			"properties": {
				
				"abc": {
					"properties": {
						"xyz": {
							"properties": {
								"http://test-url.com/extension/user-id": {
									"type": "long",
									"fields": {
										"keyword": {
											"type": "keyword"
										}
									}
								},
								"http://test-url.com/extension/username": {
									"type": "text",
									"fields": {
										"keyword": {
											"type": "keyword"
										}
									}
								}


							}


						}
					}
				},


				"timestamp": {
					"type": "date",
					"format": "yyy-MM-dd HH:mm:ss",
					"fields": {
						"keyword": {
							"type": "keyword"
						}
					}
				},
				"version": {
					"type": "text",
					"fields": {
						"keyword": {
							"type": "keyword"
						}
					}
				}
			}
		}
	}
}

Thanks,
Deepti

[warkolm (Mark Walkom)]

That sort of fieldname is likely to cause a mapping explosion, and subsequently, lots of sparse data.
I think you'd be better off creating a nested field with something like this;

  "fieldname": "abc.xyz.http://test-url.com/extension(whatevervalue)",
  "fieldvalue": "the actual keyword value"

[elk_user1]

Hello,

Thanks for the response, but I really don't have control over the field names. Could you please help me understand the dynamic template and the ignore_above setting which is dynamically created? I mentioned these in my issue.

Thanks,
Deepti