Only one analyzed field among a not_analyzed index

Elastic Stack Elasticsearch
1

My index is not_analyzed by default. However I want to analyze the hostname for case insensitive and partial matching.

I want to do the opposite of what most people do. Instead of creating a .raw field for analyzed strings, I want to create a .anal field for not_analyzed fields matching "host" field name. I tried something like this in my template without any luck:

          "string_fields" : {
            "mapping" : {
              "fielddata" : {
                "format" : "disabled"
              },
              "index" : "not_analyzed",
              "omit_norms" : true,
              "type" : "string",
              "fields" : {
                "anal" : {
                  "index" : "analyzed",
                  "type" : "string"
                }
              }
            },
            "match_mapping_type" : "string",
            "match" : "host"
          }
2

I figured out a solution:

{
  "order" : 1,
  "template": "myindex-*",
  "settings": {
    "index.refresh_interval": "5s"
  },
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "base": {
            "mapping": {
              "index": "not_analyzed"
            },
            "match": "*",
            "match_mapping_type": "*"
          }
        }
      ]
    },
    "host_field": {
      "properties": {
        "host": {
          "type": "string",
          "fields": {
            "analyzed": {
              "type": "string",
              "index": "analyzed"
            }
          }
        }
      }
    }
  }
}
3

So this doesn't work, even though the host field is not_analyzed. Aggs are still splitting my-host into separate my and host aggregations. This should only happen when I bucket host.analyzed not host. What am I doing wrong?

4

Dynamic templates allow you to define custom mappings that can be applied to dynamically added fields based on:

You already define host field statically, then it doesn't applied to host field. If you add host2, it has index: not_analyzed.
You should add "index": "not_analyzed" to host field definition.