Hi,
I'm trying to use an underscore separated key to make array sub-elements easier to combine in searches. The key is of the form
53_dock_pt1_sometoken_tb1
where the tokens are hierarchical and I've ingested using standard settings and mapping determined by ES. The intention is to allow users to query using wildcards anywhere in the string of their choice or use the keyword to target a specific key e.g.
lookup_key: 53_dock_pt*
When I look at the keys in Discover I can see that sometimes it's preserved in full but some keys lose one of the underscores e.g.
"lookup_key": [
"53dock_pt1_sometoken_tb1"
]
I'm not sure if elsewhere in the index, different underscores may have been removed.
Here is the mapping created by ES:-
"lookup_key": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
The key is in an array element and I'm using ES/Kibana 7.3 in dev where I've seen this (although I've got 6.8 in production).
How can I preserve the full string with all the underscores, as intended for this one field?