# Metric beats mappings for optional data

**URL:** <https://discuss.elastic.co/t/metric-beats-mappings-for-optional-data/225588>\
**Category:** Beats\
**Created:** [March 29, 2020, 8:58pm UTC](https://discuss.elastic.co/t/metric-beats-mappings-for-optional-data/225588 "2020-03-29T20:58:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wahaj](https://avatars.discourse-cdn.com/v4/letter/w/958977/32.png) [@wahaj](https://discuss.elastic.co/u/wahaj)\
**Post date:** [March 29, 2020, 8:58pm UTC](https://discuss.elastic.co/t/metric-beats-mappings-for-optional-data/225588/1 "2020-03-29T20:58:36Z")

</div>

I am trying to write a mapping for a custom metric beat whose goal is to capture the number of network connections for a list of protocols. There will be certain hosts, where a certain protocol will not be supported, while on some hosts all protocols will be supported. I have a couple of options that I'm contemplating:

1. Have a separate event (i.e. ES document) for each protocol. In case a host doesn't support that protocol, don't log anything to ES for that protocol.
2. Having a single document for all protocols, with # of connections for each. In case the protocol is not supported on this host, the value will be 0.
3. Have the same structure as (2), however, in case a protocol is not supported on the host, simply remove that key-value pair, instead of adding a 0 value. That is, there will be only one event for all the protocols, but it will only have data for the protocols that this hosts supports. Eventually, there will be variance in the documents across hosts.

The issue with 1 is that it uses more storage, since other meta data in the event document will get duplicated for each event.  
Between 2 and 3, I'm trying to understand if there are any performance implications, when doing queries with Kibana. (2) will use more storage, hence 3 seems the most efficient.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2020, 10:58pm UTC](https://discuss.elastic.co/t/metric-beats-mappings-for-optional-data/225588/2 "2020-04-26T22:58:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.