Unexpected "Nesting" for Single Property on IndexRequests Failing

Elastic Stack Elasticsearch
1

Hi all, I recently started using Elasticsearch and I was a bit baffled when I tried to create an IndexRequest to one of my indices using the following payload and receiving a limit of mapping depth exceeded message:

"stringAttributes": {
    "64": "0",
    "66": "test_device",
    "3": "https://app.test.com/files/123",
    "67": "https://test.com/static/ng/appSecurlets/index.html",
    "68": "https://test.com/static/ng/appThreats/index.html#/?deeplink=users&user_email=test@test.com",
    "72": "test.com",
    "8": "DAR",
    "73": "test@test.com",
    "9": "securlet.test",
    "11": "https://app.test.com/files/123",
    "14": "test@test.com",
    "15": "/All Files/",
    "26": "796fe895-fd17-4276-a5da-02c033ee0d00",
    "42": "787890963328_5790318",
    "43": "file",
    "45": "test@test.com",
    "46": "test@test.com",
    "47": "Test Testerson",
    "48": "unknown",
    "49": "https://test/static/ng/appSecurlets/index.html#/test?identification=787890963328&instance=5790318&exposure=unexposed",
    "50": "https://test/static/ng/appForensics/index.html#/?user=test@test.com&app=Box&range_from=1628535622&range_to=1629140422",
    "51": "https://test/static/ng/appSecurlets/index.html#/test?deeplink=exposed_users&user_email=test@test.com",
    "53": "https://test/static/ng/appControls/index.html",
    "55": "Test",
    "59": "300df250-aef9-4311-89e0-5e1c02e7b314"
  }

which is being sent to Elastic via a simple IndexRequest:

return Requests.indexRequest()
                .index(index)
                .type("_doc")
                .source(jsonObject, XContentType.JSON)

As far as I can tell, there is little to no nesting going on, so I’m not quite sure why the request would be rejected. Any ideas? Maybe I’m just missing something or misunderstanding Elastic’s use of nesting? While I can see that there are over 20 properties beneath the attributes (which would exceed the default depth of 20), they are all siblings, so I’d expect the depth here to not necessarily increase for all of these elements below the top level one.

Any ideas?

2

By having arbitrary string attributes as field names, you are creating a new field mapping for every number as a key. The more different numbers you have the bigger your mapping will be. I suppose that the names of the attributes can be anything?

You can also check this be retrieving the mapping back of your affected index.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.