惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

SecWiki News
SecWiki News
I
InfoQ
The Cloudflare Blog
人人都是产品经理
人人都是产品经理
博客园 - Franky
T
Tailwind CSS Blog
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
量子位
博客园_首页
罗磊的独立博客
V
V2EX
李成银的技术随笔
大猫的无限游戏
大猫的无限游戏
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
T
True Tiger Recordings
Vercel News
Vercel News
Cyberwarzone
Cyberwarzone
Cisco Talos Blog
Cisco Talos Blog
F
Fox-IT International blog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
M
Microsoft Research Blog - Microsoft Research
Know Your Adversary
Know Your Adversary
爱范儿
爱范儿
The Register - Security
The Register - Security
G
Google Developers Blog
The Hacker News
The Hacker News
Malwarebytes
Malwarebytes
S
Securelist
博客园 - 三生石上(FineUI控件)
Jina AI
Jina AI
T
Threat Research - Cisco Blogs
T
The Exploit Database - CXSecurity.com
S
SegmentFault 最新的问题
博客园 - 叶小钗
F
Fortinet All Blogs
Apple Machine Learning Research
Apple Machine Learning Research
宝玉的分享
宝玉的分享
博客园 - 聂微东
T
Threatpost
博客园 - 【当耐特】
D
Docker
P
Privacy & Cybersecurity Law Blog
www.infosecurity-magazine.com
www.infosecurity-magazine.com
G
GRAHAM CLULEY
V
Visual Studio Blog
C
Cisco Blogs
IT之家
IT之家
S
Security Archives - TechRepublic
Latest news
Latest news
阮一峰的网络日志
阮一峰的网络日志

jdhao's digital space

Manage uv.lock file with Renovate Set up Python Provider for Neovim Ripgrep Config to Search Hidden Files Pre-commit Setup for Your Project I read the nvim v0.12 release note so you don't have to Return Different Values for Each Call of A Mock Migrate Python Project from Pip to Uv 德语常用不规则动词 葱油鸡腿制作 Check Trailing White Spaces in Your Project 菜谱:茄子肉丁 Node, Index, Shard in Elasticsearch Logging setup for Pytest Select fields in Elasticsearch: _source, fields and stored_fields 中式葱花饼制作 菜谱: 凉拌苤蓝(卜留克/kohlrabi) 我也有高考 PTSD Garmin Course Syncing Not Working? Prevent Accidental Index Delete in Elasticsearch How to Import GPX File into Garmin Watch Python system PATH issues When We Use Pytest 菜谱:泰式打抛牛肉 菜谱:烤箱羊肉串 How to Filter Warnings in Python/pytest 家常烤箱烤鸡腿 Comparison between Several Desktop Speakers How to Use LuaRocks Package in Neovim Macbook 外接显示器 家常萝卜炖羊排 Run the Job Immediately after Starting Scheduler in Python APScheduler Retry for Google Cloud Client 菜谱:土豆金枪鱼沙拉 菜谱:椰香咖喱鸡 凉拌绿豆宽粉制作 Make Python logging Work in GCP Liveness and Readiness Check in Kubernetes Notes on Using GCP Logging 西班牙土豆饼制作 Elasticsearch Version Conflict Error How to Use the Elasticsearch task API Speed up document indexing in Elasticsearch via bulk indexing Index refresh issue in Elasticsearch Google Cloud Storage Usage 家常煎羊排制作 凉拌茄子制作 Configure Python logging with dictConfig Debugging Wezterm Issues Black Formatter Setup for Python Project Git line ending config Garmin Forerunner 965 Essential Tips and Setups How to Download Files from Google Cloud Storage in the Databricks Workspace Notebook Databricks Cli Usage Working with Databricks Workspace Files 手抓羊肉饭制作 Databricks Init Scripts Using Virutal Environment in Python with venv File Systems in Databricks LATERAL VIEW EXPLODE in Spark 菜谱:麻婆豆腐 在德国做台湾卤肉饭 FastAPI testing and OpenAPI doc generation Change Timezone in Databricks Spark How to Profile Your Python Script/Module 菜谱:茄子肉沫 Migrating from Packer.nvim to Lazy.nvim How to Extract PDF file on macOS How to Deploy Fastapi Application with Docker Nerdfont Icon Missing after Wezterm Upgrade Pylsp setup for Neovim in 2023 How to Parse Query Param With Multiple Values in FastAPI 菜谱:土豆胡萝卜烧牛肉 Zsh Startup Files in macOS PATH Variable Changed inside Tmux on macOS? Work with JSON File in Neovim Running/importing Python code/module in Databricks Agile and Scrum 菜谱:凉拌牛肉 Awesome Command Line Tools Written in Rust How to get or set Databricks spark configuration Set Up German Version macOS Add A Custom Search Engine for Vimium 中国大陆小米手机如何使用 Google Pay 春节回乡记 滇西之行 2023 贵阳行 2023 程序员海外工作---语言篇 2023 长沙行 2023 西安行 德国工签申请指南 2022 年博客回顾 感染 omicron 记录 How to Override Default Options in Neovim Variadic Arguments in Lua How to Enable Method Autocompletion for OpenCV How to Read Local CSV File to Table in MySQL I read the nvim v0.8 release note so you do not have to Creating A Trigger in PostgreSQL Cost of Living in Shenzhen You Do Not Need a Plugin for This Feature Ctrl-left and Ctrl-right Not Working in macOS?
object vs nested type in data mapping in Elasticsearch
2025-11-19 · via jdhao's digital space

In this post, I compare the object vs nested type used in data mapping in Elasticsearch.

By default, if you have a field where value is a list of dictionary type itself, the field is indexes by Elastic as object type. The structure of each dict under the field is not preserved.

Let’s have a concrete example:

DELETE new_index
PUT new_index/_doc/1
{
  "name": [
    {
      "first": "alice",
      "last": "smith"
    },
    {
      "first": "john",
      "last": "white"
    }
  ]
}

Internally, the document is flattened to something like this:

{
  "name.first": ["alice", "john"],
  "name.last": ["smith", "white"]
}

To verify this, let’s add a second document:

PUT new_index/_doc/2
{
  "name": [
    {
      "first": "alice",
      "last": "white"
    },
    {
      "first": "john",
      "last": "smith"
    }
  ]
}

Then we search the index to find document where “name.first” is alice, and “name.last” is white:

GET new_index/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "name.first": "alice"
          }
        },
        {
          "term": {
            "name.last": "white"
          }
        }
      ]
    }
  }
}

You would expect that document with id=2 is returned, however, both document 1 and 2 are returned.

nested type mapping#

In order to correctly preserve structure of inner dictionary under the field, we need to define the “name” field as nested type. In this case, we need to explicitly setting the mapping for the “name” field before adding documents.

DELETE my_index

PUT my_index
{
  "mappings": {
    "properties": {
      "name": {
        "type": "nested"
      },
      "attribute": {
        "type": "nested",
        "properties": {
          "name": {
            "type": "keyword"
          },
          "value": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

Then let’s add two documents to this index:

PUT my_index/_doc/1
{
  "name": [
    {
      "first": "alice",
      "last": "smith"
    },
    {
      "first": "john",
      "last": "white"
    }
  ],
  "attribute": [
    {
      "name": "size",
      "value": "23"
    },
    {
      "name": "color",
      "value": "blue"
    }
  ]
}

PUT my_index/_doc/2
{
  "name": [
    {
      "first": "alice",
      "last": "white"
    },
    {
      "first": "john",
      "last": "smith"
    }
  ]
}

Now you can try to find documents where name.first is alice and name.last is white. Note that however, you need to use nested query instead of plain one above:

GET my_index/_search
{
  "query": {
    "nested": {
      "path": "name",
      "query": {
        "bool": {
          "must": [
            {
              "term": {
                "name.first": "alice"
              }
            },
            {
              "term": {
                "name.last": "white"
              }
            }
          ]
        }
      }
    }
  }
}

Now only document 2 is returned in the result.

nested vs object type#

If you define a field as nested type, internally each dict under this field is stored as a separate Lucene document. It is just on the surface, you see one document when you do the normal search.

In the output of cat-indices api, there is this docs.count field, which shows the number of Lucene documents that this index has. In the above example, field name in index new_index is object type, and we indexed 2 documents to this index. If you run the cat-indices api for new_index, you see docs.count is 2.

GET _cat/indices/new_index?v
health status index     uuid                   pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open   new_index dtWNUHroQ_OQkIRbQj8Bvw   1   1          2            0     10.9kb         10.9kb       10.9kb

For index my_index, both field name and attribute is defined as nested type, we indexed 2 documents to this index. The cat-index API shows that docs.stat is 8.

If you are interested in only the number of documents you indexed to an index, you can use the get-count API.

GET my_index/_count
GET new_index/_count