Multi field mapping and mapping explosion

By default, it seems that all my strings are dynamically mapped to a multifield like below. I am concerned with mapping explosion

Does those multi fields are counted as 2 fields? here below, REG and REG.keyword are considered as 1 field, or 2 fields?

If it is 2 fields, how can I change the dynamic mapping to map json strings into only keywords?

        "REG" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256

Additionally, what happens if I reach the 1000 fields threashold?
If I want to insert a document (logstash), what will happend with the doc?

are the existing fields indexed and the new ones ignored, or the whole document is rejected?

That should count as 2 fields as far as I know. You can control this by creating an index template with the dynamic mappings you need.

The whole document would be rejected.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.