Menu
Is there any difference between the "keyword" field type and a field that uses "not_analyzed" as analyzer in Elasticsearch? If there is one, when to use which?
541
The crucial difference between them is that Elasticsearch will analyze the Text before it's stored into the Inverted Index while it won't analyze Keyword type. Analyzed or not analyzed will affect how it will behave when getting queried.
The keyword family includes the following field types: keyword , which is used for structured content such as IDs, email addresses, hostnames, status codes, zip codes, or tags. constant_keyword for keyword fields that always contain the same value. wildcard for unstructured machine-generated content.
keyword field takes the same input and keeps as one large string, meaning it can be aggregated on, and you can use wildcard searches on it. Aggregatable means you can use it in aggregations in elasticsearch, which resembles a sql group by if you are familiar with that. In Kibana you would probably use the .
As can be seen in the breaking changes documentation, the keyword data type is a new data type coming up in ES 5. It aims at replacing the string fields with "index": "not_analyzed".
So in ES 1.x and 2.x, this declaration
"field": {
"type": "string",
"index": "not_analyzed"
}
is equivalent to this declaration in ES 5
"field": {
"type": "keyword"
}
Similarly, the text data type will replace normal analyzed string fields, so in ES 1.x and 2.x, this declaration
"field": {
"type": "string"
}
will equivalent to this declaration in ES 5
"field": {
"type": "text"
}
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
