Nested fields not created with mappiings

Elastic Stack Elasticsearch
1

Hello everyone,

I'm starting with Elasticsearch and I have created a simple one node cluster to explore its capabilities. At the moment I have been trying to put data into elasticsearch with nested json objects. I have read through documentation and several other links but I think I'm missing something here.

My goal is to have Network property with accessible sub properties i.e. Network[0].Adapter_Type however I cannot get this to work.

I'm posting into elasticsearch json which looks following :

{
    "ESXI_Name": "stewie.prd.local",
    "VM_Name": "asterix-01",
    "VM_Datastore_Name": [
      "xyz-2",
      "xyz-2",
    ],
    "VM_vCPUs": 2,
    "VM_MemoryGB": 16,
    "Guest_OS": "Microsoft Windows Server 2008 R2 (64-bit)",
    "Network": [
      {
        "VM_Name": "asterix-01",
        "Adapter_Name": "Network adapter 2",
        "Adapter_Type": "Vmxnet3",
        "PortGroup": "vlan-666",
        "Adapter_MacAddress": "00:FF:56:AF:01:05",
        "Adapter_WakeOnLan": true
      },
      {
        "VM_Name": "asterix-01",
        "Adapter_Name": "Network adapter 2",
        "Adapter_Type": "Vmxnet3",
        "PortGroup": "vlan-666",
        "Adapter_MacAddress": "00:FF:4A:87:01:05",
        "Adapter_WakeOnLan": true
      }
    ],
    "datetime": "20160325T143803Z"
}

I'm sending this to index cmdb with type of server. From what I found in documentation is that I would need to create a mapping - which I have done using the following :

{
  "mappings": {
    "server": {
      "properties": {
        "Network": {
          "type": "nested", 
          "properties": {
            "VM_Name":    { "type": "string"  },
            "Adapter_Name": { "type": "string"  },
            "Adapter_Type":     { "type": "string"   },
            "PortGroup":   { "type": "string"   },
            "Adapter_MacAddress":    { "type": "string"    },
            "Adapter_WakeOnLan":    { "type": "string"    }
          }
        }
      }
    }
  }
}

But as soon as I post any data I get Network contents as JSON i.e.

  {
  "VM_Name": "asterix-01",
  "Adapter_Name": "Network adapter 2",
  "Adapter_Type": "Vmxnet3",
  "PortGroup": "vlan-666",
  "Adapter_MacAddress": "00:FF:56:87:01:05",
  "Adapter_WakeOnLan": true
},
{
  "VM_Name": "asterix-01",
  "Adapter_Name": "Network adapter 2",
  "Adapter_Type": "Vmxnet3",
  "PortGroup": "vlan-666",
  "Adapter_MacAddress": "00:50:AA:87:D5:05",
  "Adapter_WakeOnLan": true
}

If anyone could point me into direction how I could get this properly sorted would be great!

thanks
Raf

2

Raf,

I can't figure out what your expectation is.

That last snippet that you posted, is that the Network portion of the document that you retrieved after indexing the document? That's exactly what it should look like, whether or not you declared Network to be nested. Indexing does not modify the source in any way.

By declaring that particular inner-object property of your documents to be "nested", you have enabled yourself to search for server based on multiple Network fields without crosstalk. Please see here for a thorough explanation.

Does that help?

Glen