1

Dynamic templates allow you to define custom mappings that can be applied to dynamically added fields based on:

  • the datatype detected by Elasticsearch, with match_mapping_type.
  • the name of the field, with match and unmatch or match_pattern.
  • the full dotted path to the field, with path_match and path_unmatch.

I was trying to have a default type keyword for all fields while some special fields with specific *Suffix or prefix* could have specified types as follows, but it turned out all fields will be keyword in the end unexpectedly.

{
  "order": 99,
  "index_patterns": [
    "xxxx_stats_*"
  ],
  "settings": {
    "index": {
      "number_of_shards": "6",
      "number_of_replicas": "1"
    }
  },
  "mappings": {
    "_doc": {
      "dynamic": true,
      "_source": {
        "enabled": true
      },
      "dynamic_templates": [
        {
          "strings": {
            "match_mapping_type": "*",
            "unmatch": [
              "*Time",
              "*At",
              "is*"
            ],
            "mapping": {
              "ignore_above": 256,
              "null_value": "NULL",
              "type": "keyword"
            }
          }
        },
        {
          "timeSuffix": {
            "match_mapping_type": "*",
            "match": [
              "*Time",
              "*At"
            ],
            "mapping": {
              "type": "long"
            }
          }
        },
        {
          "isPrefix": {
            "match_mapping_type": "*",
            "match": "is*",
            "mapping": {
              "type": "boolean"
            }
          }
        }
      ],
      "date_detection": false,
      "numeric_detection": true
    }
  },
  "aliases": {
    "{index}-alias": {
      
    }
  }
}
Community
  • 1
  • 1
Hearen
  • 7,420
  • 4
  • 53
  • 63

1 Answers1

2

AFAIK match and unmatch cannot be arrays, only strings or regexes. So try this:

{
  "dynamic_templates":[
    {
      "timeSuffix":{
        "match_mapping_type":"*",
        "match_pattern":"regex",
        "match":"^(.*Time)|(.*At)$",
        "mapping":{
          "type":"long"
        }
      }
    },
    {
      "isPrefix":{
        "match_mapping_type":"*",
        "match":"is*",
        "mapping":{
          "type":"boolean"
        }
      }
    },
    {
      "strings":{
        "match_mapping_type":"*",
        "mapping":{
          "ignore_above":256,
          "null_value":"NULL",
          "type":"keyword"
        }
      }
    }
  ]
}

I also find that when you move strings to the bottom, the 2 mappings above will be resolved first. Otherwise, since every segment includes match_mapping_type":"*", the first matching segment will apply. This issue may be related.

Joe - GMapsBook.com
  • 15,787
  • 4
  • 23
  • 68
  • FYI I'd recommend to map the date-like fields to the type `date`, not long. – Joe - GMapsBook.com Jun 01 '20 at 11:55
  • Thumbs up! Joe thanks for the help, it's quite helpful to understand the `regex` working way. As for the `date`, it's kind of used everywhere, I have to use the `timestamp` to follow the routines ;( any way thanks for the extra advice. – Hearen Jun 01 '20 at 13:09
  • All right, no problem! You can surely use timestamps in dates: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#built-in-date-formats – Joe - GMapsBook.com Jun 01 '20 at 13:15