There are two types of Flattened Field Types, is that correct?

Elastic Stack Elasticsearch
1

I am learning about Flattened Field Types for index mappings. Can someone confirm if my findings are correct?

There are two types of flattened field types.

1. Explicitly Flattened Field Types - This documentation is an example of an explicit flattened field type

In short, in your index mapping, you explicitly define type: flattened on the field you want flattened.

I have discovered that Explicitly Flattened Field types are not supported by Kibana Lens.

2. Automatic Array of Nested Objects Flattened Field Types (abbrev. to AANOFFT) - Some fields are automatically flattened at time of document creation. For example, consider this request:

PUT customer_orders
POST customer_orders/_doc
{
  "order_items": [
    {"quantity": 5, "product": {"name":"pencil", "price":1}},
    {"quantity": 8, "product": {"name":"book", "price":5}}
  ]
}

If you do a GET customer_orders/_mapping, you will get this:

{
  "customer_orders": {
    "mappings": {
      "properties": {
        "order_items": {
          "properties": {
            "product": {
              "properties": {
                "name": {
                  "type": "text",
                  "fields": {
                    "keyword": {
                      "type": "keyword",
                      "ignore_above": 256
                    }
                  }
                },
                "price": {
                  "type": "long"
                }
              }
            },
            "quantity": {
              "type": "long"
            }
          }
        }
      }
    }
  }
}

In other words, no where in the mapping does it state that each object in the order_items is flattened, even though they actually are.

AANOFFT are available for use in Kibana Lens, although there are rarely any practical use cases in terms of aggregation. Attempting to use Kibana Lens to aggregate on fields that are AANOFFT will not produce intuitive results. This is why there is the concept of:

which have more practical use cases than AANOFFT.

I have a feeling I've misunderstood something, so I welcome any insight into this matter!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.