I use ElasticSearch 8.6.2 to store custom logs, I build a Java object and save it to ELC using RestHighLevelClient. The class I save in ELK:
public class DetailedLogModel {
private Map<String, Object> variables;
private String accountId;
private String event;
private String trackId;
private String requestId;
private String processInstanceId;
private String contextPath;
private String confId;
private LocalDateTime dateTime;
private String componentId;
private String componentName;
private String parentActionId;
private String parentProcessInstanceId;
private String actionId;
private ActionDetailLogType actionType;
private String uri;
private String method;
I am satisfied with automatic indexing for all fields except "variables" because it can store an indefinite number of other fields and this is a problem, how can I solve it? Everything will help, even an example of a REST request specifying body. I tried the option of creating an index with this configuration
{
"mappings": {
"properties": {
"variables": {
"type": "object",
"index": false,
"store": true
}
}
}
}
But i have error
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [variables] has unsupported parameters: [index : false] [store : true]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping: Mapping definition for [variables] has unsupported parameters: [index : false] [store : true]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [variables] has unsupported parameters: [index : false] [store : true]"
}
},
"status": 400
}
and it only works for fields with the keyword and text type. Maybe someone will tell you how to see how to view the list of indexed fields? I 'm using GET http://127.0.0.1:9200/detail_log_2023-11-23/_mapping . But this does not reflect reality, since the variables field is indexed anyway.
You need to use the enabled
mapping parameter which is specific to object fields:
{
"mappings": {
"properties": {
"variables": {
"type": "object",
"enabled": false
}
}
}
}