Open
Description
Description
When using subobjects: false with logsdb, unmapped fields that are stored in "ignored source" are flattened out, which loses the object structure the user sent originally. This is expected for fields that are reconstructed from doc values or stored fields, but for unmapped fields the original structure should be retained to allow for reindexing and source retrieval via API as close as possible to the original form.
For example:
PUT my-index
{
"settings": {
"mode": "logsdb"
},
"mappings": {
"subobjects": false,
"dynamic": false
}
}
POST my-index/_doc
{
"@timestamp": "2025",
"foo": {
"bar": {
"baz": 123
}
}
}
GET my-index/_search
// returns "foo.bar.baz": 123
In some cases this makes it impossible to reconstruct the original value, especially if dotted property names have been used in the original JSON:
POST my-index/_doc
{
"@timestamp": "2025",
"foo.bar": 123,
"foo": {
"bar": 456
}
}
GET my-index/_search
// returns "foo.bar": [123, 456 ]