The problem which i face is like this:
I have a single field like message which i want to parse it with json parser but sometimes the value which come to it is text and sometimes is json, I try to use regex like "^{.}[\s\S]$" to check it is it json then rename or move it to other field name but the problem is sometimes it is not a valid json, is there any way to check what is the type like text or object and then start parsing?
Most likely is possible with regex. Provide us with samples.
It is a bit difficult to share the samples since there are in different kinds, As far as i check there is no option to handle this on elastic side without disabling mapping?
Simplify, provide us with begging of lines, 1 or 2 samples. We don't need full message neither classified data such as an bank account number, IPs, etc...
You can use the ingest pipeline to process events. For mapping, it's not possible to changes field types without delete,create again.