Get all only fieldnames without its value from index

Question

How to get all only fieldnames(key name) and not the values of it from index in Elasticsearch

I tried using following request.
GET /my_index/_field_caps?fields=*&filter_path=fields.*

but above request also returning datatypes of fields.

Expected output (array or json of all fields)

{  
  fields:{  
   "field_1",  
   "field_2.subfield_1",  
   "field_2.subfield_2",  
   "field_3.subfield_1.another_field"  
  }  
}

Musab Dogan · Answer 1 · 2023-08-02T21:14:42.623

You can use the _mapping API to get the result.

PUT test_ip/_mapping
{
  "properties": {
    "IP": {
      "type": "ip"
    },
    "other_fields": {
      "type": "keyword"
    },
    "date": {
      "type": "date"
    }
  }
}

GET test_ip/_mapping

output:

{
  "test_ip": {
    "mappings": {
      "properties": {
        "IP": {
          "type": "ip",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "date": {
          "type": "date"
        },
        "other_fields": {
          "type": "keyword"
        },
        "text": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

If you want to see more pretty results, you can use some script to modify the result.

Here is a python script result:

musab@192 elasticsearch % python3 get_fields.py
{
  "IP.keyword": "keyword",
  "date": "date",
  "other_fields": "keyword",
  "text.keyword": "keyword"
}

Here is the Python code:

import requests
import json

def parse_properties(properties, parent_key='', path_dict={}):
    for k, v in properties.items():
        new_key = f"{parent_key}.{k}" if parent_key else k
        if 'properties' in v:
            parse_properties(v['properties'], new_key, path_dict)
        elif 'fields' in v:
            parse_properties(v['fields'], new_key, path_dict)
        else:
            path_dict[new_key] = v['type']
    return path_dict

response = requests.get('http://localhost:9200/test_ip/_mapping').json()
properties = response['test_ip']['mappings']['properties']
fields = parse_properties(properties)
print(json.dumps(fields, indent=2))

EDIT: Here is the more accurate one

vim get_fields.py

#this script is listing ALL field names and field types of the selected index.
import requests
import json

# Define Elasticsearch endpoint, username, and password
ES_URL = 'https://localhost:9200'
USERNAME = 'elastic'
PASSWORD = 'your_elasticsearch_password'

def parse_properties(properties, parent_key='', path_dict={}):
    for k, v in properties.items():
        new_key = f"{parent_key}.{k}" if parent_key else k
        path_dict[new_key] = v['type']
        if 'properties' in v:
            parse_properties(v['properties'], new_key, path_dict)
        elif 'fields' in v:
            parse_properties(v['fields'], new_key, path_dict)
    return path_dict

def index_exists(index_name):
    url = f'{ES_URL}/{index_name}'
    response = requests.head(url, auth=(USERNAME, PASSWORD))
    return response.status_code == 200

def get_mapping(index_name):
    url = f'{ES_URL}/{index_name}/_mapping'
    response = requests.get(url, auth=(USERNAME, PASSWORD)).json()
    properties = response[index_name]['mappings']['properties']
    fields = parse_properties(properties)
    return fields

def main():
    index_name = input("Enter the index name: ")
    if not index_exists(index_name):
        print(f"Error: Index '{index_name}' does not exist.")
        return

    fields = get_mapping(index_name)
    print(json.dumps(fields, indent=2))

if __name__ == "__main__":
    main()

the output for the updated script:

python3 get_fields.py

Enter the index name: test_ip
{
  "IP": "ip",
  "IP.keyword": "keyword",
  "date": "date",
  "other_fields": "keyword",
  "test2": "geo_point",
  "text": "text",
  "text.keyword": "keyword"
}

GET test_ip/_mapping
{
  "test_ip": {
    "mappings": {
      "properties": {
        "IP": {
          "type": "ip",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "date": {
          "type": "date"
        },
        "other_fields": {
          "type": "keyword"
        },
        "test2": {
          "type": "geo_point"
        },
        "text": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

Get all only fieldnames without its value from index

1 Answers1

EDIT: Here is the more accurate one