I am trying to figure out a good way to support a use case where an IP field needs to be both analyzed and indexed for ipv4 range queries (as type 'ip'), and stored as-is (as string) for display purpose. It would seem like multi-field might work for this.
But one trick is that it turns out that values may also contain ipv6 values; and as a preparation step, then, we want to just retain "raw" value, but omit ipv4 indexable value. So: instead of feeding a single value (say, "caller-ip") that would then have raw string as main value, and 'ip' valued indexed one, it would seem necessary to send values separately. Still, from modeling perspective, it would seem nice to have the values be associated. So my question is this: is it possible to pass separate values using dotted notation when inserting document (so, JSON contain 'caller-ip.caller-ip' and 'caller-ip.ipv4') and offer separate values for these sub-fields. Or should I just create 2 separate fields, and not try to use multi-fields for this case? So basically: is the dotted notation only applicable when querying values, or is it general short-cut that can be used on indexing/insertion side as well. -+T atu +- -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAL4a10h405Va_hofxwOovMJLr4rsh%2BwOXQe1H7xN8J%3DMo6ssCQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
