Use the object data type to model hierarchical JSON, such as an employee address or an email with attachments. An inner object contains its own properties, which Elasticsearch maps as fields within the document. section 4.3.1 section 4.6.2
Keep these behaviors in mind:
- Define inner fields inside a properties object; Elasticsearch infers the object type for inner objects by default, so address or attachments need not declare type: object. section 4.3.1 section 4.6.2
- Search inner fields with dotted paths such as attachments.filename. Use a match query for analyzed text or a term query on a keyword field for exact values. section 4.6.2
- Remember that object arrays are flattened rather than stored as individual documents, so relationships between fields inside separate array elements are lost. section 4.6.2
Map and search email attachments
Create an emails index with attachments.filename and attachments.filetype as inner text fields. Index an email containing {"attachments":{"filename":"file1.txt","filetype":"confidential"}}, then search with {"query":{"match":{"attachments.filename":"file1.txt"}}}. The dotted path addresses the inner field, while the match query finds the indexed filename.
