Create a keyword field concatenated of other fields

Question

I've got an index with a mapping of 3 fields. Let's say f1, f2 and f3.
I want a new keyword field with the concatenation of the values of f1, f2 and f3 to be able to aggregate by it to avoid having lots of nested loops when checking the search results.

I've seen that this could be achieved by source transformation, but since elastic v5, this feature was deleted.

ElasticSearch version used: 6.5

Q: How can I archieve the concatenation in ElasticSearch v 6.5?

Answer 1

There was indeed source transformation prior to ES 5, but as of ES 5 there is now a more powerful feature called ingest nodes which will allow you to easily achieve what you need:

First, define an ingest pipeline using a set processor that will help you concatenate three fields into one:

PUT _ingest/pipeline/concat
{
  "processors": [
    {
      "set": {
        "field": "field4",
        "value": "{{field1}} {{field2}} {{field3}}"
      }
    }
  ]
}

You can then index a document using that pipeline:

PUT index/doc/1?pipeline=concat
{
  "field1": "1",
  "field2": "2",
  "field3": "3"
}

And the indexed document will look like:

{
  "field1": "1",
  "field2": "2",
  "field3": "3",
  "field4": "1 2 3"
}

Just make sure to create the index with the appropriate mapping for field4 prior to indexing the first document.