multi field mapping elasticsearch

Question

I'm trying to map a multi field in elasticsearch

1st field - 'in' should contain all the indexed column,
2nd field - 'orig' should contain the text as-is.

For example:

    "findings": {
       "type": "multi_field",
       "fields": {
          "in": {
             "type": "string"
          },
          "orig": {
             "type": "string",
             "index":"not_analyzed"
          }
       }

Once I create this and query this is how it looks.

When index = 'no' does it mean the field will never be indexed at all?

  "findings": {
                  "type": "string",
                  "index": "no",
                  "fields": {
                     "in": {
                        "type": "string"
                     },
                     "orig": {
                        "type": "string",
                        "index": "not_analyzed"
                     }
                  }

score 2 · Answer 1 · answered Feb 06 '16 at 04:10

Multi_fields have been removed from elasticsearch for long.

Instead, any of the core field types (excluding object and nested) now accept a fields parameter, as also shown in OP's second example.

However, When you specify fields inside any other field, it simply means copying the content to a different field and apply a different set of analyzers for querying on the same content.

So when you specify index=no , the field is not indexed as such and hence is not searchable but the inner fields have properties of their own.

You may also use copy_to to copy the content to other fields and specify the different analyzers there but then there is no 'explicit' relationship between the two fields which is pretty explicit in multi_fields as new fields are accessed as 'findings.in' or 'findings.orig'

you have used "type": "multi_field" in first mapping whereas "type":"string" in your second mapping. Second mapping was being referred as 2nd example — Rahul, Feb 08 '16 at 06:12

Richa · Accepted Answer · 2016-02-06T03:25:27.460

"index" : "no" has got different meaning for different types. Since findings field in your question is String it has following meaning according to elasticsearch documentation.

no means that it won’t be searchable at all (as an individual field; it may still be included in _all). Setting to no disables include_in_all.

you can not directly search for the field findings as it has got index: no while you can search it using findings.in or findings.orig

You can study more about index property here

multi field mapping elasticsearch

2 Answers2

Linked