Dynamic templates support default types?

Question

Dynamic templates allow you to define custom mappings that can be applied to dynamically added fields based on:

• the datatype detected by Elasticsearch, with match_mapping_type.
• the name of the field, with match and unmatch or match_pattern.
• the full dotted path to the field, with path_match and path_unmatch.

I was trying to have a default type keyword for all fields while some special fields with specific *Suffix or prefix* could have specified types as follows, but it turned out all fields will be keyword in the end unexpectedly.

{
  "order": 99,
  "index_patterns": [
    "xxxx_stats_*"
  ],
  "settings": {
    "index": {
      "number_of_shards": "6",
      "number_of_replicas": "1"
    }
  },
  "mappings": {
    "_doc": {
      "dynamic": true,
      "_source": {
        "enabled": true
      },
      "dynamic_templates": [
        {
          "strings": {
            "match_mapping_type": "*",
            "unmatch": [
              "*Time",
              "*At",
              "is*"
            ],
            "mapping": {
              "ignore_above": 256,
              "null_value": "NULL",
              "type": "keyword"
            }
          }
        },
        {
          "timeSuffix": {
            "match_mapping_type": "*",
            "match": [
              "*Time",
              "*At"
            ],
            "mapping": {
              "type": "long"
            }
          }
        },
        {
          "isPrefix": {
            "match_mapping_type": "*",
            "match": "is*",
            "mapping": {
              "type": "boolean"
            }
          }
        }
      ],
      "date_detection": false,
      "numeric_detection": true
    }
  },
  "aliases": {
    "{index}-alias": {
      
    }
  }
}

Answer 1

AFAIK match and unmatch cannot be arrays, only strings or regexes. So try this:

{
  "dynamic_templates":[
    {
      "timeSuffix":{
        "match_mapping_type":"*",
        "match_pattern":"regex",
        "match":"^(.*Time)|(.*At)$",
        "mapping":{
          "type":"long"
        }
      }
    },
    {
      "isPrefix":{
        "match_mapping_type":"*",
        "match":"is*",
        "mapping":{
          "type":"boolean"
        }
      }
    },
    {
      "strings":{
        "match_mapping_type":"*",
        "mapping":{
          "ignore_above":256,
          "null_value":"NULL",
          "type":"keyword"
        }
      }
    }
  ]
}

I also find that when you move strings to the bottom, the 2 mappings above will be resolved first. Otherwise, since every segment includes match_mapping_type":"*", the first matching segment will apply. This issue may be related.