What is this nesting in my mapping and what is its purpose?

Elastic Stack Elasticsearch
1

Looking at my mappings I'm often seeing something like this. I expect to see a flat country_iso_code having type text, but what is the keyword field? I don't see this in the raw data, I just see a country code value. Could it be that some of the data, which is machine-generated, has a nested structure? Thanks

        "country_iso_code": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
2

It's automatically generated by elasticsearch because you did not define a mapping.
It helps you in case you want to sort on country_iso_code.keyword or compute aggregations on it, which you can't do on country_iso_code.

3

Thanks! So, does that mean there would be an explicit field called 'keyword' or country_iso_code.keyword? I don't see any evidence that my data source ever generated a field called country_iso_code.keyword. Also, I can't find what you're talking about in the documentation for mapping.

4

Elasticsearch never modifies the _source field which contains exactly what you sent.
This field is generated in Lucene.