Elasticsearch Field with different types-CodePudding

I try to create an index template for my heterogeneous data. Is there a way to ingest Documents with a field that is sometimes a list of lists:

{
  "xx_response_body": [
    [
      123123,
      ...
    ],
    [
      12312344,
      ...
    ],
    
    ....
  ],
  "Content-Type": "application/json",
  "Vary": "Cookie",
  "x-xss-protection": "1; mode=block"
}

and sometimes an object:

{
  "xx_response_body": {
    "abc": "error",
    "def": "content",
    "hij": {}
  },
  "Content-Type": "application/json",
  "x-xss-protection": "1; mode=block"
}
``

CodePudding user response：

You're better off by creating different fields for these types of fields or storing your data in separate indices, your future self will thank you.

There's also flattened data type that might work, but I've not used that in the past.

Another alternative approach would be storing this information as a string and using runtime fields to extract these fields if you wanted to, but that will always be slower than actually indexing them.