Mapping question for parentname

[billnbell (Bill)]

Issue: Add ability to reference parent to do aggregations with copy_to

Anyway to do this? I am new to ELK...

I would like to define: copy_to: {parentname}_all. Today I can only use {name} which does not allow the object of the parent to be referenced. I want to take fields and aggregate all children into a terms search. Kinda like _all but at the object level.

Here is an example: Note this is kinda useless, since I want to use {parentname}.

PUT /index2
{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "nested_template": {
            "path_match": "*.*",
            "match_mapping_type": "string",
            "mapping": {
              "copy_to": "{name}_all",
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "nested2_template": {
            "match": "*_all",
            "match_mapping_type": "string",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "nested2_template": {
            "path_unmatch": "*.*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        },
        {
          "notanalyzed": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      ]
    }
  }
}

[spinscale (Alexander Reelsen)]

The issue got a discuss label, so it will be checked out soon (those kind of issues are talked about regurlarly). Please dont cross post into the forum, just because you did not get an immediate answer.

have you considered using an ingest processor?

[billnbell (Bill)]

OK. Is there another way to solve this?

address (object)
address.street
address.city
address.state
address.zip

search: address: 80031

I don't want it to show in _source if possible, but want that type of query to work. A copy_to field would be good, since it does not show in _source. But when processing no idea how I can create a copy_to field "text" and copy all the children nodes into it.

[spinscale (Alexander Reelsen)]

Hey,

then copy_to sounds right, how about something like this?

PUT /index2
{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "nested_template": {
            "path_match": "address.*",
            "match_mapping_type": "string",
            "mapping": {
              "copy_to": "address.full",
              "type": "string"
            }
          }
        }
      ]
    }
  }
}

PUT index2/foo/bar
{
  "address" : {
    "street" : "Baker Street 223",
    "city": "London"
  }
}

GET index2/_search?q=address.full=baker

GET index2/_search?q=address.full=london

--Alex

[billnbell (Bill)]

Yeah. Pefect. However, we want it to be generic, we don't know the
"address' - and want it to work on any child - as we add more objects to
the index.

PUT index2/address/1 { "address" : { "street" : "Baker Street 223", "city":
"London" } }
PUT index2/pizza/2 { "pizza" : { "type" : "Large", "price": "13.00" } }
PUT index2/physicians/3 { "name" : { "first" : "Phil", "last": "Simms" } }