Disable indexing parameters with type "object" in index ElasticSeacrh

Question

I use ElasticSearch 8.6.2 to store custom logs, I build a Java object and save it to ELC using RestHighLevelClient. The class I save in ELK:

public class DetailedLogModel {

    private Map<String, Object> variables;
    private String accountId;
    private String event;
    private String trackId;
    private String requestId;
    private String processInstanceId;
    private String contextPath;
    private String confId;
    private LocalDateTime dateTime;
    private String componentId;
    private String componentName;
    private String parentActionId;
    private String parentProcessInstanceId;
    private String actionId;
    private ActionDetailLogType actionType;
    private String uri;
    private String method;

I am satisfied with automatic indexing for all fields except "variables" because it can store an indefinite number of other fields and this is a problem, how can I solve it? Everything will help, even an example of a REST request specifying body. I tried the option of creating an index with this configuration

{
  "mappings": {
    "properties": {
      "variables": {
        "type": "object",
        "index": false, 
        "store": true     
      }
    
    }
  }
}

But i have error

{
    "error": {
        "root_cause": [
            {
                "type": "mapper_parsing_exception",
                "reason": "Mapping definition for [variables] has unsupported parameters:  [index : false] [store : true]"
            }
        ],
        "type": "mapper_parsing_exception",
        "reason": "Failed to parse mapping: Mapping definition for [variables] has unsupported parameters:  [index : false] [store : true]",
        "caused_by": {
            "type": "mapper_parsing_exception",
            "reason": "Mapping definition for [variables] has unsupported parameters:  [index : false] [store : true]"
        }
    },
    "status": 400
}

and it only works for fields with the keyword and text type. Maybe someone will tell you how to see how to view the list of indexed fields? I 'm using GET http://127.0.0.1:9200/detail_log_2023-11-23/_mapping . But this does not reflect reality, since the variables field is indexed anyway.

Answer 1

You need to use the enabled mapping parameter which is specific to object fields:

{
  "mappings": {
    "properties": {
      "variables": {
        "type": "object",
        "enabled": false  
      }
    
    }
  }
}