What is this nesting in my mapping and what is its purpose?

Looking at my mappings I'm often seeing something like this. I expect to see a flat country_iso_code having type text, but what is the keyword field? I don't see this in the raw data, I just see a country code value. Could it be that some of the data, which is machine-generated, has a nested structure? Thanks

        "country_iso_code": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },

It's automatically generated by elasticsearch because you did not define a mapping.
It helps you in case you want to sort on country_iso_code.keyword or compute aggregations on it, which you can't do on country_iso_code.

Thanks! So, does that mean there would be an explicit field called 'keyword' or country_iso_code.keyword? I don't see any evidence that my data source ever generated a field called country_iso_code.keyword. Also, I can't find what you're talking about in the documentation for mapping.

Elasticsearch never modifies the _source field which contains exactly what you sent.
This field is generated in Lucene.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.