1

I have two Elastic Search version one is 7.3 and the second is 7.1. I am using flattened data type for Elastic Search 7.3 and I also want to use this data type in Elastic Search 7.1. So that I can store my data as I stored in Elastic Search 7.3.
I researched about flattened data type and get to know that it's supported to 7.x but when I tried in 7.1 it gives me the mapper_parsing_exception error.
What I tried is as shown below.

  • In Elastic Search 7.3

    Index Creation

    PUT demo-flattened
    Response: 
       {
    "acknowledged": true,
    "shards_acknowledged": true,
    "index": "demo-flattened"
   }

    Insert Mapping

        PUT demo-flattened/_mapping
    {
        "properties": {
            "host": {
                "type": "flattened"
            }
        }
    }
    Response: 
        {
        "acknowledged": true
    }
  • In Elastic Search 7.1 
     PUT demo-flattened
    Response: 
       {
    "acknowledged": true,
    "shards_acknowledged": true,
    "index": "demo-flattened"
   }

    Insert Mapping

        PUT demo-flattened/_mapping
    {
        "properties": {
            "host": {
                "type": "flattened"
            }
        }
    }
    Response: 
       {
       "error": {
           "root_cause": [
               {
                   "type": "mapper_parsing_exception",
                   "reason": "No handler for type [flattened] declared on field [host]"
               }
           ],
           "type": "mapper_parsing_exception",
           "reason": "No handler for type [flattened] declared on field [host]"
       },
       "status": 400
   }

I want to use the flattened data type in Elastic Search 7.1. Is there any alternative to use flattened data type in the 7.1 version because flattened data type is supported from Elastic Search 7.3.

Any help or suggestions will be appreciated.

Deep Dalsania
  • 375
  • 3
  • 8
  • 22

3 Answers3

0

First the flattened is available in 7.1 with X-pack (X-pack is paid feature), so what I think you can use object type with enabled flag as false This will help you store that field as it is without any indexing.

{
        "properties": {
            "host": {
                "type": "object",
                "enabled": false
            }
        }
    }
Abhishek Singh
  • 11
  • 1
  • Thank you for your answer. I read about ```object``` type with ```enabled``` mapping attribute and as well as ```flattened``` field type. I don't think so it's relevant because purpose of both ways are different. Despite this , I'll try your solution. – Deep Dalsania Dec 05 '21 at 08:49
0

Check the version of your ElasticSearch. If its the OSS version, then it won't work for you.

You can check it by running GET \ in the Kibana. You would get something like:

{
  "version" : {
    "number" : "7.10.2",
    "build_flavor" : "oss",
  }
}

But for ElasticSearch that does support flattened type, you would get something like:

  "version" : {
    "number" : "7.10.2",
    "build_flavor" : "default",
   }
}

You can find more details on the official Kibana Github page No handler for type [flattened] declared on field [state] #52324.

user1927829
  • 302
  • 3
  • 9
-1

Interally, it works like this

Similarities in the way values are indexed, flattened fields share much of the same mapping and search functionality as keyword fields

Here, You have only one field called host. You can replace this with keyword.

What similarities:

Mapping:

"labels": {
        "type": "flattened"
      }

Data:

"labels": {
    "priority": "urgent",
    "release": ["v1.2.5", "v1.3.0"],
    "timestamp": {
      "created": 1541458026,
      "closed": 1541457010
    }
  }

During indexing, tokens are created for each leaf value in the JSON object. The values are indexed as string keywords, without analysis or special handling for numbers or dates

To query them, you can use "term": {"labels": "urgent"} or "term": {"labels.release": "v1.3.0"}.

When it is keyword, you can have them as separate fields.

{
 "host":{
   "type":"keyword"
 }
}

Reference

Gibbs
  • 21,904
  • 13
  • 74
  • 138
  • Thank you for your answer @Gibbs and sorry to say that I already referred a document and you can check in the document `flattened` data type is available from 7.3 and I need in 7.1 and my data is too large i.e domain report from virus total so I want alternative of `flattened` data type in 7.1 so that I can store same data as a single object in 7.1 like in 7.3 – Deep Dalsania Jul 05 '20 at 02:39
  • Unfortunately not possible unless you overwrite open source code. – Gibbs Jul 05 '20 at 06:20