Multi field mapping and mapping explosion

Elastic Stack Elasticsearch
1

By default, it seems that all my strings are dynamically mapped to a multifield like below. I am concerned with mapping explosion

Does those multi fields are counted as 2 fields? here below, REG and REG.keyword are considered as 1 field, or 2 fields?

If it is 2 fields, how can I change the dynamic mapping to map json strings into only keywords?

        "REG" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
2

Additionally, what happens if I reach the 1000 fields threashold?
If I want to insert a document (logstash), what will happend with the doc?

are the existing fields indexed and the new ones ignored, or the whole document is rejected?

3

That should count as 2 fields as far as I know. You can control this by creating an index template with the dynamic mappings you need.

The whole document would be rejected.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.