difference between a field and the field.keyword
Solution 1:
Update : A short answer would be that type: text is analyzed, meaning it is broken up into distinct words when stored, and allows for free-text searches on one or more words in the field. The .keyword field takes the same input and keeps as one large string, meaning it can be aggregated on, and you can use wildcard searches on it. Aggregatable means you can use it in aggregations in elasticsearch, which resembles a sql group by if you are familiar with that. In Kibana you would probably use the .keyword field with aggregations to count distinct values etc.
Please take a look on this article about text
vs. keyword
.
Briefly: since Elasticsearch 5.0 string
type was replaced by text
and keyword
types. Since then when you do not specify explicit mapping, for simple document with string:
{
"some_field": "string value"
}
below dynamic mapping will be created:
{
"some_field": {
"type" "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
As a consequence, it will both be possible to perform full-text search on
some_field
, and keyword search and aggregations using thesome_field.keyword
field.
I hope this answers your question.
Solution 2:
Look at this issue. There is some explanation of your question in it. Roughly speaking some_field
is analyzed and can be used for fulltext search. On the other hand some_field.keyword
is not analyzed and can be used in term queries or in aggregation.