Mapping is the process of defining how a document, and the fields it contains, are stored and indexed. For instance, use mappings to define: which string fields should be treated as full text fields. which fields contain numbers, dates, or geolocations. whether the values of all fields in the document should be indexed into the catch-all _all field. the format of date values. custom rules to control the mapping for dynamically added fields.
Mapping is the process of defining how a document and the fields it contains are stored and indexed. For example, use a map to define:
》Which strings should be treated as a whole and not divided
》Which fields contain numbers, dates, or geographic information
"Should field values in documents be indexed to match all fields
》Format of the date value
》Custom rules control the mapping of dynamically added fields
| 1 2 3 4 5 6 7 8 9 10 |
|
map type
Each index will have a mapping type that determines how it is indexed
Deprecated in [6.0.0], query deprecated mapping types
The types of mappings are:
1. Original field: The original field is used to define how to process the metadata in the document. The original field includes the document index, type, _id field and _source field
2. Fields or attributes: The mapping type contains a list of document-related fields or attributes
Field datatypesedit Each field has a data type which can be: 1、a simple type like text, keyword, date, long, double, boolean or ip. 2、a type which supports the hierarchical nature of JSON such as object or nested. 3、or a specialised type like geo_point, geo_shape, or completion. It is often useful to index the same field in different ways for different purposes. For instance, a string field could be indexed as a text field for full-text search, and as a keyword field for sorting or aggregations. Alternatively, you could index a string field with the standard analyzer, the english analyzer, and the french analyzer. This is the purpose of multi-fields. Most datatypes support multi-fields via the fields parameter.
the data type of the field
Each field has a data type that functions as follows:
1. Simple types such as text (the default word segmentation and a wordless .keywork), keyword, date, long, double, boolean, ip
2. Object or nested that supports the hierarchical nature of json (nested entities can be searched independently)
3. There are also more professional geo_point, geo_shape, and completion types
It is often useful to index the same field in different ways for different purposes. For example, a string field can be indexed as a text field for full-text search and as a key field for sorting or aggregation. Alternatively, string fields can be indexed using the standard, English, and French analyzers.
This is the multi-domain purpose. Most data types support multiple fields through the field parameter.
Settings to prevent mappings explosione Defining too many fields in an index is a condition that can lead to a mapping explosion, which can cause out of memory errors and difficult situations to recover from. This problem may be more common than expected. As an example, consider a situation in which every new document inserted introduces new fields. This is quite common with dynamic mappings. Every time a document contains new fields, those will end up in the index’s mappings. This isn’t worrying for a small amount of data, but it can become a problem as the mapping grows. The following settings allow you to limit the number of field mappings that can be created manually or dynamically, in order to prevent bad documents from causing a mapping explosion:index.mapping.total_fields.limitThe maximum number of fields in an index. The default value is1000.index.mapping.depth.limitThe maximum depth for a field, which is measured as the number of inner objects. For instance, if all fields are defined at the root object level, then the depth is1. If there is one object mapping, then the depth is2, etc. The default is20.index.mapping.nested_fields.limitThe maximum number ofnestedfields in an index, defaults to50. Indexing 1 document with 100 nested fields actually indexes 101 documents as each nested document is indexed as a separate hidden document.
Prevent map explosion
Defining too many fields in an index can cause the map to blow up, which can lead to memory errors and hard-to-recover situations. This problem may be more common than expected. For example, consider a situation where each new document inserted introduces a new field. This is very common in dynamic mapping. Mapping of the index ends whenever a document contains a new field. For small amounts of data this is not a concern, but as the map grows it can become a problem. The following settings allow you to limit the number of automatically or manually generated fiels, preventing mapping explosions from corrupting the document:
index.mapping.total_fields.limit: The maximum number of fields in the index. The default value is 1000
index.mapping.depth.limit: The maximum depth of a field, which is measured as the number of internal objects. For example, if all fields are defined at the root object level, the depth is 1. If there is an object map, the depth is 2, and so on. The default value is 20.
index.mapping.nested_fields.limit: The maximum number of nested fields in the index, the default is 50. Indexing a document with 100 nested fields actually indexes 101 documents because each nested document is indexed as a separate hidden document.
Dynamic mappingedit Fields and mapping types do not need to be defined before being used. Thanks to dynamic mapping, new field names will be added automatically, just by indexing a document. New fields can be added both to the top-level mapping type, and to inner object and nested fields. The dynamic mapping rules can be configured to customise the mapping that is used for new fields. Explicit mappingsedit You know more about your data than Elasticsearch can guess, so while dynamic mapping can be useful to get started, at some point you will want to specify your own explicit mappings. You can create field mappings when you create an index, and you can add fields to an existing index with the PUT mapping API.
Dynamic mapping:
Fields and mapping types do not need to be defined before they can be used. Thanks to dynamic mapping, simply indexing a document will automatically add new field names. New fields can be added to top-level mapped types and inner objects and nested fields.
Dynamic mapping rules can customize the mapping for new fields.
Explicit mapping:
You know more about your data than elasticsearch, so while dynamic mapping can be useful, in some cases you need to specify your own explicit mapping.
You can create field mappings when you create an index, and you can use the PUT mapping API to add fields to an existing index.
Updating existing field mappings Other than where documented, existing field mappings cannot be updated. Changing the mapping would mean invalidating already indexed documents. Instead, you should create a new index with the correct mappings and reindex your data into that index.
Update existing field mappings
Existing field mappings cannot be updated except for document records, and changing the mapping will invalidate the original index. Instead, you should create a new index with the correct mapping to rebuild your index
Example mapping
A mapping could be specified when creating an index, as follows:
The mapping should be specified when creating the index
PUT my_index
{
"mappings": {
"doc": {
"properties": {
"title": { "type": "text" },
"name": { "type": "text" },
"age": { "type": "integer" },
"created": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}