Keyword type schema difference Elasticsearch 5.1 with 5.5

Elastic Stack Elasticsearch
1

I have been using elasticsearch 2.X to 5.1 for quite some time for aggregation. The business logic does not need the string fields to be analysed.
In 5.1 when I set the field type as follows in the mapping template:
"myfield_name" : {
"type" : "keyword"
},
I can see in kibana management -> index pattern , the field definition is like this

image
image.png892×67 3.6 KB

But when I am trying out elasticsearch 5.5, the same setting of
"myfield_name" : {
"type" : "keyword"
},
Kibana index pattern shows there are two fields: myfield_name and myfield_name.keyword
image

Will it waste space in 5.5 to have two fields of different type to represent one field?
How can I define the schema to only have 1 field like elasticsearch 5.1?

2

Are you using Logstash?

3

Yes, I am using logstash 5.5

4

Then chances are that your template is not matching, and so the default Logstash one applies, which creates both a text and a keyword mapping of the field.

6

It'd be better if you raised another thread please.
That way we can help you directly and ask more relevant questions :slight_smile:

7

Done! Thank you and sorry :slight_smile:

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.