CODEWITHSUNDEEP
elasticsearch
pracsec
pracsec

Reputation: 330

How do I get Elasticsearch to add .keyword field?

I am trying to get fields with the name "IP" to be mapped as "ip" type with a .keyword field of type "keyword". The following mapping is not creating the .keyword field. How do I make elastic map this field?

"IP": {
    "type": "ip",
    "fields": {
      "keyword": {
        "type": "keyword",
        "ignore_above": 256
      }
    }
}

Upvotes: 0

Views: 952

Answers (2)

pracsec
pracsec

Reputation: 330

TLDR: Need to flush the index after mappings are created.

The mappings are being created dynamically with dynamic mapping rules. When the first object comes through the new mapping is created. This information does not make it to Visualizations in Kibana immediately. You may have to flush the index after the mapping is created to make the new fields populate when building Visualizations.

Upvotes: 0

Musab Dogan
Musab Dogan

Reputation: 3680

I'm sharing an example for you to test it.

Please note that after you add the keyword field you should run POST index_name/_update_by_query to update the existing data.

create the index
PUT test_ip
{
  "mappings": {
    "properties": {
      "IP": {
        "type": "ip"
      },
      "other_fields": {
        "type": "keyword"
      }
    }
  }
}
(working) update the mapping with _mapping API
PUT test_ip/_mapping
{
  "properties": {
    "IP": {
      "type": "ip",
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 256
        }
      }
    }
  }
}
(error) If you are testing like the following, you will get an error.
PUT test_ip
{
  "mappings": {
    "properties": {
      "IP": {
        "type": "ip",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      }
    }
  }
}
The error:
> {   "error": {
>     "root_cause": [
>       {
>         "type": "resource_already_exists_exception",
>         "reason": "index [test_ip/xBXNCAjnRjODoAAY3TGFBA] already exists",
>         "index_uuid": "xBXNCAjnRjODoAAY3TGFBA",
>         "index": "test_ip"
>       }
>     ],
>     "type": "resource_already_exists_exception",
>     "reason": "index [test_ip/xBXNCAjnRjODoAAY3TGFBA] already exists",
>     "index_uuid": "xBXNCAjnRjODoAAY3TGFBA",
>     "index": "test_ip"   },
>.    "status": 400 }

Upvotes: 0

Related Questions