Mapping Json Object and Array under the same field

Elastic Stack Elasticsearch
1

Hello,

I'm trying to ingests logs that are json documents. As I don't know the structure of each possible logs, I'm looking into dynamic templates. And I encounter an issue because I have a case where a field is an object in one case and an array in another case.

Ex:
doc1

{
  "inputPayload": [
    {
      "priority": 2,
      "refId": "e9b0cfe9-5426-4082-9b30-ba81c807910f"
    },
    {
      "priority": 2,
      "refId": "76a82805-fdea-4376-b762-f839ad3ec122"
    }
  ]
}

doc2

{
  "inputPayload": [
    "d92bb07c-b6c5-4634-8622-7bed1740be12",
    "d92bb07c-b6c5-4634-8622-7bed1740be13"
  ]
}

I don't really need to have doc1 indexed as an structured object. Is there a combination of settings to index those 2 documents under the same index? Or a least a way to index the object as a text.

For now I've tested to:

  • use flattened type, but flattened type is not compatible with the array
  • use enabled on the object, but once I've indexed a array document, I get an error on the object document.

Thanks for your help,

2

Regarding enabled, what did you try? I tried this and it worked. However this means, that no data is searchable. Is that ok for you or not?

{
  "mappings": {
    "properties": {
      "inputPayload": {
        "type": "object",
        "enabled": false
      }
    }
  }
}

Neither flattened nor nested would solve your use-case, unless you are willing to restructure that JSON data structure.

1 Like
3

Thanks, I've tried it and it works!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.