Mapping conflict between object, text, & keyword

[datdoo (Vin)]

I have this mapping currently

"response": {
          "properties": {
            "body": {
              "properties": {
                "id": {
                  "type": "long"
                },
                "jsonrpc": {
                  "type": "text",
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "result": {
                  "properties": {
                    "isBootstrapped": {
                      "type": "boolean"
                    }
                  }
                }
              }
            }

The response.body.result is sometimes an object that looks like this

{
    "jsonrpc": "2.0",
    "result": {
        "isBootstrapped": true
    },
    "id": 1
}

Other times the response.body.result is Text/keyword which looks like this.

{
    "jsonrpc": "2.0",
    "id": 1,
    "result": "0x16951ef"
}

Because of this, when Filebeat tries to index some calls an error occurs on this field "object mapping for [response.body.result] tried to parse field [result] as object, but found a concrete value".

How to update mapping to allow all response.body.result logs to be indexed? Both objects and text for this particular field.

[Christian_Dahlqvist]

That is not possible. You will need to change the structure of your documents of index data with different mappings into different indices.

[datdoo (Vin)]

Would something like this help in my case just for the response.body.result field?

{
  "mappings": {
    "properties": {
      "result": {
        "type": "object",
        "enabled": false
      }
    }
  }
}

I understand that Kibana won't be able to filter or search for this field but would it help with the error I am seeing in Filebeat?

Also what you said is an interesting solution. Can you please provide some documentation that I can learn more about this method?