Dynamic templates in Elasticsearch - Step-by-Step Execution

Concept Flow - Dynamic templates

Start Index Mapping

↓

Receive Document Field

↓

Check Dynamic Templates

↓

Apply Template

↓

Map Field

↓

Continue for Next Field

↓

End

When a document is indexed, each field is checked against dynamic templates. If a template matches, it applies custom mapping; otherwise, default mapping is used.

Execution Sample

Elasticsearch

{
  "dynamic_templates": [
    {
      "strings_as_keywords": {
        "match_mapping_type": "string",
        "mapping": { "type": "keyword" }
      }
    }
  ]
}

This dynamic template maps all string fields as keyword type instead of the default text.

Execution Table

Step	Field Name	Field Type	Template Match?	Mapping Applied	Notes
1	title	string	Yes	keyword	Matches 'strings_as_keywords' template
2	views	long	No	long	No template matches, default mapping used
3	description	string	Yes	keyword	Matches template again
4	date	date	No	date	Default mapping for date type
5	tags	array of strings	Yes	keyword	Template applies to each string in array
6	END	-	-	-	All fields processed, mapping complete

💡 All document fields checked; dynamic templates applied where matched, default mapping otherwise.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
field_name	-	title	views	description	date	tags	-
field_type	-	string	long	string	date	array of strings	-
template_match	-	Yes	No	Yes	No	Yes	-
mapping_applied	-	keyword	long	keyword	date	keyword	-

Key Moments - 3 Insights

Why does the 'views' field not match the dynamic template?

Because the template only matches fields of type 'string', and 'views' is a 'long' (number) type, so default mapping is used (see execution_table row 2).

How does the template apply to the 'tags' field which is an array?

Dynamic templates apply to each element in the array individually. Since 'tags' is an array of strings, each string matches the template and is mapped as 'keyword' (see execution_table row 5).

What happens if no dynamic template matches a field?

The field uses Elasticsearch's default mapping for its type, as shown for 'date' and 'views' fields (see execution_table rows 2 and 4).

Visual Quiz - 3 Questions

Look at the execution table, what mapping is applied to the 'description' field at step 3?

A text

B long

C keyword

D date

💡 Hint

Check the 'Mapping Applied' column at step 3 in the execution_table.

At which step does the condition 'Template Match?' become 'No' for the first time?

A Step 2

B Step 4

C Step 1

D Step 5

💡 Hint

Look at the 'Template Match?' column in the execution_table and find the first 'No'.

If the dynamic template was changed to match 'long' types instead of 'string', what would happen to the 'views' field mapping?

A It would be mapped as 'long' (default)

B It would be mapped as per the new template

C It would be mapped as 'keyword'

D It would cause an error

💡 Hint

Refer to variable_tracker and execution_table to see how template matching affects mapping.

Concept Snapshot

Dynamic templates let you customize how fields are mapped when indexing documents.
They check each field's type and name against rules.
If a template matches, its mapping is applied.
Otherwise, default mapping is used.
Useful to control indexing without defining full mappings upfront.

Full Transcript

Dynamic templates in Elasticsearch allow automatic mapping customization for fields during indexing. When a document is indexed, each field is checked against the dynamic templates defined in the index mapping. If a field matches a template's criteria, the mapping specified in that template is applied to the field. If no template matches, Elasticsearch applies its default mapping based on the field's data type. For example, a template can specify that all string fields should be mapped as keyword type instead of the default text type. This process repeats for every field in the document until all are mapped. This approach helps manage dynamic data with flexible mapping rules.

Practice

1. What is the main purpose of dynamic_templates in Elasticsearch?

easy

A. To automatically map new fields based on user-defined rules

B. To manually define each field's mapping one by one

C. To delete old indexes automatically

D. To backup data to another cluster

Solution

1. Step 1: Understand dynamic templates concept

   Dynamic templates let Elasticsearch automatically apply mapping rules to new fields without manual intervention.

2. Step 2: Compare options with concept

   Only To automatically map new fields based on user-defined rules describes automatic mapping based on rules, which matches the purpose of dynamic templates.

3. Final Answer:

   To automatically map new fields based on user-defined rules -> Option A

4. Quick Check:

   Dynamic templates = automatic mapping rules [OK]

Hint: Dynamic templates automate field mapping using rules [OK]

Common Mistakes:

• Thinking dynamic templates delete or backup data
• Confusing manual mapping with dynamic templates
• Assuming dynamic templates only work for existing fields

2. Which of the following is the correct syntax to define a dynamic template that matches fields ending with _date and maps them as date type?

easy

A. "dynamic_templates": [{"dates": {"match": "*_date", "mapping": {"type": "date"}}}]

B. "dynamic_templates": [{"dates": {"match_pattern": "regex", "match": ".*_date$", "mapping": {"type": "date"}}}]

C. "dynamic_templates": [{"dates": {"match": "date", "mapping": {"type": "date"}}}]

D. "dynamic_templates": [{"dates": {"path_match": "*_date", "mapping": {"type": "date"}}}]

Solution

1. Step 1: Identify correct syntax for regex matching

   To match fields ending with '_date', we use match_pattern": "regex" and match": ".*_date$".

2. Step 2: Verify mapping type

   The mapping type should be date as required.

3. Final Answer:

   "dynamic_templates": [{"dates": {"match_pattern": "regex", "match": ".*_date$", "mapping": {"type": "date"}}}] -> Option B

4. Quick Check:

   Regex match + date type = "dynamic_templates": [{"dates": {"match_pattern": "regex", "match": ".*_date$", "mapping": {"type": "date"}}}] [OK]

Hint: Use match_pattern: regex for pattern matching [OK]

Common Mistakes:

• Using match without match_pattern for regex
• Using path_match instead of match for field names
• Incorrect regex syntax or missing $ anchor

3. Given this dynamic template snippet in Elasticsearch mapping:

{
  "dynamic_templates": [
    {
      "strings_as_keywords": {
        "match_mapping_type": "string",
        "mapping": {
          "type": "keyword"
        }
      }
    }
  ]
}

What will be the type of a newly indexed field named username with string value?

medium

A. "text"

B. "object"

C. "keyword"

D. "string"

Solution

1. Step 1: Analyze the dynamic template rule

   The template matches fields of type "string" and maps them as "keyword" type.

2. Step 2: Apply rule to field "username"

   Since "username" is a string field, it will be mapped as "keyword" according to the template.

3. Final Answer:

   "keyword" -> Option C

4. Quick Check:

   String fields mapped as keyword = "keyword" [OK]

Hint: match_mapping_type: string maps to keyword here [OK]

Common Mistakes:

• Assuming default type is text instead of keyword
• Confusing match and match_mapping_type
• Thinking string type is valid mapping in Elasticsearch 7+

4. You wrote this dynamic template but it does not apply to fields ending with _id. What is the error?

{
  "dynamic_templates": [
    {
      "ids": {
        "match": "*_id",
        "mapping": {
          "type": "keyword"
        }
      }
    }
  ]
}

medium

A. Incorrect mapping type, should be "text" instead of "keyword"

B. Dynamic templates must be outside the mappings block

C. Field name should be "path_match" not "match"

D. Missing "match_pattern": "regex" to enable wildcard matching

Solution

1. Step 1: Identify the matching issue

   The pattern "*_id" uses a wildcard, which requires "match_pattern": "regex" or "wildcard" to work properly.

2. Step 2: Confirm mapping and placement

   The mapping type "keyword" is correct for IDs, and dynamic templates are correctly placed inside mappings.

3. Final Answer:

   Missing "match_pattern": "regex" to enable wildcard matching -> Option D

4. Quick Check:

   Wildcard match needs match_pattern [OK]

Hint: Add match_pattern for wildcard or regex matches [OK]

Common Mistakes:

• Forgetting match_pattern with wildcards
• Changing mapping type unnecessarily
• Placing dynamic templates outside mappings

5. You want to create a dynamic template that maps all numeric fields with names containing _count as long type, but only if the field value is greater than zero. Which approach correctly applies this logic?

hard

A. Dynamic templates cannot filter by field value; use mapping for "long" and filter in queries

B. Use a dynamic template with match for "*_count" and mapping type "long"; add a runtime field to check > 0

C. Use a dynamic template with match for "*_count" and mapping type "long"; then filter documents with a query for values > 0

D. Use a dynamic template with match for "*_count" and mapping type "long" with a condition for > 0

Solution

1. Step 1: Understand dynamic templates capabilities

   Dynamic templates define field mappings based on name or type patterns, but cannot apply conditions based on field values.

2. Step 2: Identify correct approach for value filtering

   Filtering by field value (> 0) must be done at query time, not mapping time.

3. Final Answer:

   Dynamic templates cannot filter by field value; use mapping for "long" and filter in queries -> Option A

4. Quick Check:

   Value filtering = query, not mapping [OK]

Hint: Dynamic templates map fields; value filters happen in queries [OK]

Common Mistakes:

• Trying to filter field values in dynamic templates
• Adding unsupported 'condition' in mapping
• Confusing mapping with query filtering