Type of a Field

Elastic Stack Kibana
1

Hi Everyone,

How can we make the type of a field(exception) permanently as object ?

I am facing issue where the type of the field sometimes gets assigned as text but required is object. According to the log which is first logged when roll over happens the field type will be decided as text or object.

2

Hello,
Try explicitly defining the mapping of exception as an object. Also stopping dynamic mapping so it doesn't try to figure out what to use. Here's an example in an index template:

PUT _index_template/object-logs-test-template
{
  "index_patterns": ["object-logs-test*"],
  "template": {
    "mappings": {
      "dynamic": false,
      "properties": {
        "exception": {
          "type": "object",
          "enabled": true
        }
      }
    }
  }
}

Now create the index, add a doc, and observe the mapping:

PUT object-logs-test

POST object-logs-test/_doc?refresh=wait_for
{
  "timestamp": "2025-06-17T16:30:00Z",
  "message": "Test exception mapping",
  "exception": {
    "foo": "bar"
  }
}

GET object-logs-test/_mapping

The object should come through but not anything else, as dynamic is turned off:

{
  "object-logs-test": {
    "mappings": {
      "dynamic": "false",
      "properties": {
        "exception": {
          "type": "object"
        }
      }
    }
  }
}
3

Hi Justin,
Its clear. I would like to know if any other data which comes other than in form of object for example number will that log totally be rejected ?

4

Suggest to read:

and

In your specific case, the type "object" is explicitly excluded from the use of ignore_malformed, which would be a common approach in these cases.

I guess you could try to use ingest pipelines to tidy up any bad input data ... often better to try to "fix" this sort of issue at source (excuse the pun).

1 Like