Elasticsearch flattened Field Data Type

The flattened field data type in Elasticsearch is used to index entire JSON objects as single fields. It's particularly useful when dealing with objects that have an unknown or arbitrary number of keys, or when you want to index the entire object without creating separate fields for each nested property.

Flattened fields are an alternative to using nested objects or object fields. They offer better performance and lower storage overhead compared to nested fields, especially when you don't need to query or aggregate on individual nested properties. However, they provide less flexibility in terms of querying and aggregating on specific nested fields.

Example

PUT my-index
{
  "mappings": {
    "properties": {
      "user": {
        "type": "flattened"
      }
    }
  }
}

PUT my-index/_doc/1
{
  "user": {
    "name": "John Doe",
    "age": 30,
    "address": {
      "city": "New York",
      "country": "USA"
    }
  }
}

In this example, the entire "user" object is indexed as a single flattened field.

Common Issues and Misuses

1. Overuse: Using flattened fields for all object types can lead to reduced query flexibility.
2. Query limitations: You can't perform queries or aggregations on individual nested properties within a flattened field.
3. Mapping conflicts: Flattened fields don't handle mapping conflicts well if the structure of the object changes significantly.
4. Size limitations: Flattened fields have a default limit of 1000 leaf values per field.

Frequently Asked Questions

Q: When should I use a flattened field instead of a nested field?
A: Use flattened fields when you don't need to query or aggregate on individual nested properties and want better performance and lower storage overhead.

Q: Can I update individual properties within a flattened field?
A: No, you can't update individual properties. You need to reindex the entire object to make changes.

Q: What's the performance impact of using flattened fields?
A: Flattened fields generally offer better indexing and query performance compared to nested fields, especially for large numbers of nested objects.

Q: Is there a limit to the number of properties in a flattened field?
A: Yes, by default, flattened fields have a limit of 1000 leaf values. This can be adjusted using the depth_limit parameter in the mapping.

Q: Can I use wildcard queries on flattened fields?
A: Yes, you can use wildcard queries on flattened fields, but they will match against the entire serialized object, not individual properties.