Use the nested data type when an array contains objects whose fields must stay associated. It preserves each inner object as an independent unit instead of allowing a search to combine values from different array elements. section 4.6.3
Email attachments
An email can contain two attachments: file1.txt classified as confidential and file2.txt classified as private. Searching for file1.txt with private classification should return no results. A regular object mapping can produce a false positive by matching the filename from one attachment with the classification from another; nested mapping keeps those values together. section 4.6.3
Listing 4.29 Mapping the schema definition for the nested type
PUT emails_nested
{
"mappings": {
"properties": {
"attachments": {
"type": "nested", #1
"properties": {
"filename": { #2
"type": "keyword"
},
"filetype": {
"type": "text" #3
}
}
}
}
}
}
The mapping declares attachments as nested, filename as keyword, and filetype as text. The keyword mapping keeps filenames such as file1.txt intact for exact structured matching. section 4.6.3
Listing 4.31 Fetching results matching a filename and classification
GET emails_nested/_search
{
"query": {
"nested": { #1
"path": "attachments", #2
"query": {
"bool": {
"must": [ #3
{ "match": { "attachments.filename": "file1.txt" }},
{ "match": { "attachments.filetype": "private" }}
]
}
}
}
}
}
The search uses a nested query with path attachments and requires both filename and filetype conditions within the same inner object. The indexed document structure appears in the accompanying attachment example. section 4.6.3
