4 ms·
> For example, consider the documents {"value": 42} and {"value": "foo"}. To index this, index {"value::int": 42} and {"value::str": "foo"} instead. Now you hav
by mr_toad 2y ago
> For example, consider the documents {"value": 42} and {"value": "foo"}. To index this, index {"value::int": 42} and {"value::str": "foo"} instead. Now you have two distinct fields that don't conflict with each other.
But now all my queries that look for “value” don’t work. And I’ve got two columns in my report where I only want one.
- atombender 2y agoThe query layer would of course handle this. ELK has KQL, which could do it for you, but it doesn't. That's why I'm saying it's a design mistake. If your data mixes data types, I would argue that your report (whatever that is) _should_ get two columns.