# Mapping multiple properties to a single one **URL:** \ **Category:** Logs\ **Created:** [June 15, 2021, 8:59am UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966 "2021-06-15T08:59:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mats990](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mats990/32/37516_2.png) [@mats990](https://discuss.elastic.co/u/mats990)\ **Post date:** [June 15, 2021, 8:59am UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966/1 "2021-06-15T08:59:31Z")
Hi, Let's say you have a cluster with application logs. And since multiple applications are sending data to the cluster they have different properties. For example, one application will send a log message in the "message" property while the other would send it in the "msg" property. How should one configure the mapping to preserve those fields but also have the possibility to use a single "message" property for all applications? I know there is a "copy\_to" feature but is that the only option there is? Are there some other options? Thanks ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [June 15, 2021, 10:00am UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966/2 "2021-06-15T10:00:45Z")
Hi @mats990, that's an interesting question. Here's what my checklist would be: 1. Try to align the field names to [ECS](https://www.elastic.co/guide/en/ecs/current/index.html) before ingesting (e.g. via a beats processors, logstash transforms or an [ingest pipelines](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)). I know it's not always possible, but I wanted to make sure it's mentioned again. 😉 2. If that's not possible, make sure to index into different indices with specific mappings for each source. A common prefix like `logs-app1.stdout` and `logs-app2.debug` still allow for querying across all of them using `logs-*`. But it has the advantage of keeping the individual mappings small and focused. 3. In the individual mappings [alias fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/field-alias.html) can be used to align the field names without duplicating the data. 4. If a simple field alias doesn't work [runtime fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html) allow for the creation of fields that are evaluated at query time. Hope this can give you some ideas. ---
**Author:** ![mats990](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mats990/32/37516_2.png) [@mats990](https://discuss.elastic.co/u/mats990)\ **Post date:** [June 25, 2021, 6:33pm UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966/3 "2021-06-25T18:33:47Z")
Hi @weltenwort , Thank you for a detailed answer. I'd like to avoid 1st solution since I wouldn't like to mutate fields, just to add additional ones. I like 2nd and 3rd solutions since they combined give me exactly what I need. However, since we currently have all app logs in the same index it's not trivial to do that at the moment. Do you think something similar might be possible with [copy\_to](https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html) feature? We could take 2 fields and "merge" them in a single field, since our logs have only 1 field filled, the "copy\_to" field would be either one of those which is not empty 🤔 I'd like to avoid 4th solution if possible due to performance reasons Thanks again! ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [June 28, 2021, 11:21am UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966/4 "2021-06-28T11:21:18Z")
> [@mats990](#): > > Do you think something similar might be possible with [copy\_to](https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html) feature? 🤔 yes, that should work as well as far as querying is concerned. Not sure whether the display in the Logs UI might be negatively affected, TBH. One thing to keep in mind is that compared to aliases or field renaming it uses up more storage space due to the duplication. In terms of architecture cleanliness and maintainability I'd recommend to perform that copying in an earlier step during the ingestion (such as in logstash or an ingest pipeline). Or are the apps writing to Elasticsearch directly? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2021, 11:21am UTC](https://discuss.elastic.co/t/mapping-multiple-properties-to-a-single-one/275966/5 "2021-07-26T11:21:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.