Question About Dynamically Generated Keyword Fields

Elastic Stack Elasticsearch
1

I am getting ready to make the jump from 2.4 to 5.X and see that string fields are now dynamically mapped as both a text and keyword field by default. My question is, does it hurt anything to leave the keyword field in place even though I will never be using it for aggregations, etc? Would doing so cause unnecessary bloat in the index? I have a lot of fields and would prefer not to have to manually edit the dynamically generated mapping if at all possible. Any guidance/thoughts that anyone may have would be appreciated. Thanks.

Kevin

2

Yes, indexing strings twice (once as type text and once as type keyword) will cause more disk space to be consumed. How much more depends on your data.

If that's a concern, and you are never going to use strings for aggregating or sorting, you could use dynamic templates to map strings to text only, without having to define the type of each field explicitly. Take a look at the docs which have this exact example: https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html#_literal_text_literal_only_mappings_for_strings

You could use dynamic templates in combination with index templates. Then all new indexes with a name that matches the provided wildcard pattern will have your dynamic template applied to them by default: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

1 Like
3

@abdon Thank you very much for the info!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.