Hello,
I have an ES index with following schema:
{ "_all": {"enabled": False}, "dynamic_templates": [ {"values": { "path_match": "tags.*", "mapping": { "type": "object", "properties": { "values": {"type": "string", "analyzer": "tag_value"}, "numeric_values": {"type": "float"} } } }} ], "properties": { "pg_id": {"type": "string", "index": "not_analyzed"}, "delete_hash": {"type": "string", "index": "not_analyzed"}, "resource_id": {"type": "integer"}, "timestamp": {"type": "date"}, "permanent": {"type": "boolean"}, "request_id": {"type": "string", "index": "not_analyzed"}, "log_level": {"type": "string", "analyzer": "simple"}, "message": {"type": "string", "analyzer": "simple"}, "namespace": {"type": "string", "index": "not_analyzed"}, "tags": { "type": "object" }, "tag_list": {"type": "string", "analyzer": "tag_value"} } }
I want to store logs with tags like action:foo or amount:55.5 etc. and then do some aggregations on them,
Everything works fine for me, however at one point there may be thousands of tags used in application and every single tag wii create a new mapping on tags object - are there any gotchas performance implications with this approach when tags object will have potentially thousands of keys?