What does object datatype mapping with value parameter mean?

[Jun_Zhang]

I found following settings in my index mapping, it was created by metricbeat. what does value prarameter mean?

            "prophet": {
              "properties": {
                "4paradigm": {
                  "properties": {
                    "com/addon": {
                      "type": "keyword",
                      "ignore_above": 1024
                    },
                    "com/system": {
                      "type": "keyword",
                      "ignore_above": 1024
                    }
                  }
                },
                "value": {
                  "type": "keyword",
                  "ignore_above": 1024
                }
              }
            },

[dadoonet (David Pilato)]

It's the name of a field that might exist in your json document. But only you might know the answer as we don't know how you created the mapping or how your documents look like.

[Jun_Zhang]

@dadoonet thanks for answer.

The mapping was created by metricbeat automatically. But, according to Object field type | Elasticsearch Guide [8.11] | Elastic , object datatype doesn't have value parameter.

when metricbeat push event to elasticsearch, it printed following warn log :

{"type":"mapper_parsing_exception","reason":"failed to parse [docker.container.labels.prophet]","caused_by":{"type":"illegal_state_exception","reason":"Can't get text on a START_OBJECT at 1:1998"}}

[Jun_Zhang]

I tested with following request, elasticsearch refused correctly，so I wonder why metricbeat created that mapping successfully.

PUT test
{
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas": 0
    },
    "mappings" : {
        "_doc" : {
            "properties" : {
                "test" : { 
                  "properties": {
                    "name": {"type": "keyword"},
                    "aget": {"type": "long"}
                  },
                  "value": {
                    "type": "keyword"
                  }
                }
            }
        }
    }
}

ES Responsed：

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Mapping definition for [test] has unsupported parameters:  [value : {type=keyword}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [_doc]: Mapping definition for [test] has unsupported parameters:  [value : {type=keyword}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Mapping definition for [test] has unsupported parameters:  [value : {type=keyword}]"
    }
  },
  "status": 400
}

[dadoonet (David Pilato)]

Please format your code, logs or configuration files using </> icon as explained in this guide and not the citation button. It will make your post more readable.

Or use markdown style like:

```
CODE
```

This is the icon to use if you are not using markdown format:

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.
Please update your post.

Here I guess that value is misplaced and should be at the same level as aget.

[Jun_Zhang]

sorry, @dadoonet! updated.

[dadoonet (David Pilato)]

Try:

PUT test
{
    "settings" : {
        "number_of_shards" : 1,
        "number_of_replicas": 0
    },
    "mappings" : {
        "_doc" : {
            "properties" : {
                "test" : { 
                  "properties": {
                    "name": {"type": "keyword"},
                    "aget": {"type": "long"},
                    "value": { "type": "keyword" }
                  }
                }
            }
        }
    }
}