# Suggested mappings for highly structured data

**URL:** <https://discuss.elastic.co/t/suggested-mappings-for-highly-structured-data/192547>\
**Category:** Elasticsearch\
**Created:** [July 28, 2019, 1:31am UTC](https://discuss.elastic.co/t/suggested-mappings-for-highly-structured-data/192547 "2019-07-28T01:31:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TeraInferno](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/terainferno/32/40302_2.png) [@TeraInferno](https://discuss.elastic.co/u/TeraInferno)\
**Post date:** [July 28, 2019, 1:31am UTC](https://discuss.elastic.co/t/suggested-mappings-for-highly-structured-data/192547/1 "2019-07-28T01:31:35Z")

</div>

Hello. I have over a trillion documents that are similar to the following:

```
{
    "ip": "192.168.1.1",
    "mac_address": "00:0a:95:9d:68:16",
    "email_address": "somebody@domain.com",
    "url": "some.domain.com/with/some/path?and_options=true",
    "phone": "111-111-1111",
    "count": 9000,
    "message": "A really interesting messaging containing a lot of text"
}

```

I am going to want to query my data using any one of these fields. I will also want to be able to write queries where I can find out if any field _contains_, _starts with_, or _ends with_ with they term searched on.

I am looking suggestions on what mapping, analyzers, normalizers, and tokenizers I should use.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2019, 1:31am UTC](https://discuss.elastic.co/t/suggested-mappings-for-highly-structured-data/192547/2 "2019-08-25T01:31:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.