I'm struggling with dynamic mappings. My docs (coming from logs) include a parameters object with lots of nested properties, that I want to partially index.
Especially, I have some fields that I want to dynamically map to token type, ex:
parameters.applicationId
parameters.userId
... etc (all what I need is first level in parameters)
And some fields to exclude:
parameters.authorization
parameters.access_token
parameters.body.* (body and all subproperties)
I tried with regex, or playing on orders of dynamic_mappings without success. Either it indexes nothing, or indexes a field I don't want.
Right now, I tried this (and it indexes access_token wrongly).
PUT _template/calls
{
"index_patterns": ["calls-v1.1.0*"],
"mappings" : {
"_source" : {
"enabled" : true
},
"dynamic_templates": [
{
"parameters_template": {
"path_match": "parameters.access_token",
"mapping": { "enabled": false }
}
},
{
"parameters_template": {
"path_match": "parameters.authorization",
"mapping": { "enabled": false }
}
},
{
"parameters_template": {
"path_match": "parameters.body",
"mapping": { "enabled": false }
}
},
{
"parameters_template": {
"path_match": "parameters.*",
"mapping": {
"type": "keyword"
}
}
}
],
"properties" : {
"headers" : {
"enabled" : false
},
"stack" : {
"type" : "keyword"
},
...
GET /calls-v1.1.0-2019-12-reindexed/_mapping
{
"calls-v1.1.0-2019-12-reindexed" : {
"mappings" : {
"dynamic_templates" : [...],
"properties" : {
...
"parameters" : {
"properties" : {
"accessId" : {
"type" : "keyword"
},
"access_token" : {
"type" : "text"
},
...