Hi, I have for my date fields the date in .raw format and the same field duplicated without.raw ending but as a String value.
Why is this?
The most likely reason is you are using logstash (or some other loader) that added an index template to elasticsearch. According to this template, any unknown string field will be indexed twice - one time as an analyzed field (x) and as not analyzed fields (x.raw). The analyzed version allows performing full text search and not analyzed version is needed for exact matches and aggregations (See "Exact values versus full text" section of the guide for more informaiton). Since logstash doesn't know how you are planning to use a new fields, in indices it both ways just in case.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.