elastic / elastic/roadmap

Search flattened fields in ES|QL to avoid mapping explosion

Open
#53 1 comment 0 reactions 1 assignee Assigned to @tylerperk View on GitHub
Component: Elasticsearch product-area:observability product-area:search product-area:security v9.5.0
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**Value Proposition**

Elasticsearch's flattened field type is sometimes used for indexing objects with a large or unknown number of unique keys, such as AWS Cloudtrail logs. This avoids mapping explosion by having one field where there might otherwise be tens of thousands of fields. ES|QL does not yet support the flattened field type.

**Expected Outcome**

Users will be able to retrieve fields from within flattened fields in ES|QL queries, which enables them to filter on the field values, aggregate them, and apply other ES|QL features. This unlocks analytics on these fields that was previously not possible with ES|QL.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.