elasticsearchmappingelasticsearch-mappingelasticsearch-template

Elasticsearch template field mapping not working


I have defined the following template for a particular index:

curl -XPUT http://localhost:9200/_template/template_1 -d '{
"template": "new_dashboard_1",
"mappings": {
    "_default_" : {
   "_all" : {"enabled" : true},
   "dynamic_templates" : [ {
     "string_fields" : {
       "match" : "*",
       "match_mapping_type" : "string",
       "mapping" : {
         "type" : "string", "index" : "analyzed", "omit_norms" : true,
           "fields" : {
             "raw" : {"type": "string", "index" : "not_analyzed"}
           }
       }
     }
   }
  } ]
}
}'

My intention here is to create a .raw type for any string values and set the index as "not_analyzed"..

But when I create some test data and verify, .raw fields are not being created in the first place.

curl -XPOST http://localhost:9200/new_dashboard_1/type/ -d '{
  "sensors": {
    "_reading": "26 Celsius",
    "_state": "Normal",
    "augmentation": {},
    "_slot": "7",
    "_name": "Temp: INLET"
  },
  "ipAddress": "10.0.0.2"
}'

curl -XGET http://localhost:9200/new_dashboard_1/type/_search?q=*:*                                                                                                                  

{
  "took": 35,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 1,
    "hits": [
      {
        "_index": "new_dashboard_1",
        "_type": "type",
        "_id": "AVE-IUsW_nEkXpEfOb2D",
        "_score": 1,
        "_source": {
          "sensors": {
            "_reading": "26 Celsius",
            "_state": "Normal",
            "augmentation": {},
            "_slot": "7",
            "_name": "Temp: INLET"
          },
          "ipAddress": "10.0.0.2"
        }
      }
    ]
  }
}

Anything I need to change?


Solution

  • The raw field is created but it is not "visible", in that it is not added to the _source that you've sent for indexing. However, if you run (e.g.) an aggregation on any raw sub-field you'll get some results:

    {
      "size": 0,
      "aggs": {
        "ips": {
          "terms": {
            "field": "ipAddress.raw"
          }
        }
      }
    }
    

    Also if you get the mapping after indexing your document, you'll also see the raw field in there:

    curl -XGET localhost:9200/new_dashboard_1/_mapping/type