Search flattened fields in ES|QL to avoid mapping explosion
- Dominant language
- No language data
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
**Value Proposition**
Elasticsearch's flattened field type is sometimes used for indexing objects with a large or unknown number of unique keys, such as AWS Cloudtrail logs. This avoids mapping explosion by having one field where there might otherwise be tens of thousands of fields. ES|QL does not yet support the flattened field type.
**Expected Outcome**
Users will be able to retrieve fields from within flattened fields in ES|QL queries, which enables them to filter on the field values, aggregate them, and apply other ES|QL features. This unlocks analytics on these fields that was previously not possible with ES|QL.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.