Map fields in Streams
Serverless Stack
After selecting a stream, map fields either after creating a processor on the Processing tab or from the Schema tab.
Field mappings define how Elasticsearch stores and indexes your data, balancing storage efficiency against query performance.
Unmapped fields can still be searched using runtime fields, but these incur higher query costs.
After identifying which fields you query most often, you can map them to improve performance, at the cost of additional storage. For more background, refer to the Mapping overview.
After you create a processor, open the Detected fields tab to view any fields it extracted. Streams automatically attempts to map these fields so you can use them in queries.
From here, you can:
- Accept the suggested field mapping.
- Change an incorrect field mapping to the correct type.
- Remove the mapping from a field.
The Schema tab provides an overview of how fields are defined within your stream.
Classic streams: the Schema tab lists all fields found in the underlying index or index template. Each field shows its mapping status and type, either Mapped or Unmapped.
Wired streams: Stack Serverless the Schema tab determines field mappings by combining information from the current stream’s index and its parent streams. Fields with a type defined in a parent stream have the Inherited status. You can navigate to that parent stream to view or edit the mapping (except for fields defined in the root logs stream, which you can't modify).
When you add a mapping to a wired stream, all of its child streams automatically inherit it.
To edit field mappings from the Schema tab:
- Open the Field actions menu by selecting the icon.
- Select Map field.
- From the Type dropdown, select the desired field type.
- Select Stage changes to save your updates.