ElasticSearch | How to create mapping for an object, with key = timestamp and value = list

Question

In ElasticSearch, I'm trying to create the mapping for a the following data structure:

"timelineData": {
        "1249689600000": [
            {
                /* left out */
            }
        ],
        "1234396800000": [
            {
                /* left out */
            },
            {
                /* left out */
            },
        ]
}

I have tried the following:

timelineData: {                                 
    properties: {                               
        type: 'nested',                         
        properties: {                           
            /* left out */                            
        }                                       
    }                                           
}   

Creating the index throws the following error:

[mapper_parsing_exception] No handler for type [{type=text}] declared on field [properties]
                                      

Question: How can I create a ES mapping for the above data structure?

Answer 1

You can use a dynamic mapping template:

PUT timeline_index
{
  "mappings": {
    "dynamic_templates": [
      {
        "ts_nested": {
          "path_match":   "timelineData.*",
          "mapping": {
            "type": "nested"
          }
        }
      }
    ],
    "properties": {
      "timelineData": {
        "type": "nested"
      }
    }
  }
}

---

Do consider, though, that you may soon hit the issue of having too many keys to keep track of and/or hitting the ES limit on inner fields. Similarly, you'll be limited in terms of accessing the shared attributes of the inner /* left out */ objects as discussed in Terms aggregation with nested wildcard path.

So I'd suggest the following:

{
  "timelineData": [
    {
      "timestamp": 1249689600000,
      "data": [{},{}, ...]
    }
  ]
}

If you apply a date mapping to the timestamp, you'll get the benefit of being able to perform date-range queries & aggs.