I am trying to figure out a good way to support a use case where an IP
field needs to be both analyzed and indexed for ipv4 range queries (as type
'ip'), and stored as-is (as string) for display purpose. It would seem like
multi-field might work for this.
But one trick is that it turns out that values may also contain ipv6
values; and as a preparation step, then, we want to just retain "raw"
value, but omit ipv4 indexable value.
So: instead of feeding a single value (say, "caller-ip") that would then
have raw string as main value, and 'ip' valued indexed one, it would seem
necessary to send values separately.
Still, from modeling perspective, it would seem nice to have the values be
associated.
So my question is this: is it possible to pass separate values using dotted
notation when inserting document (so, JSON contain 'caller-ip.caller-ip'
and 'caller-ip.ipv4') and offer separate values for these sub-fields.
Or should I just create 2 separate fields, and not try to use multi-fields
for this case?
So basically: is the dotted notation only applicable when querying values,
or is it general short-cut that can be used on indexing/insertion side as
well.
-+T atu +-
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAL4a10h405Va_hofxwOovMJLr4rsh%2BwOXQe1H7xN8J%3DMo6ssCQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.