Change mapping of index-pattern fields to text

[lukasolson]

Fixes #9352.

This simply changes the type of all JSON fields in the index-pattern mapping from keyword to text. This change is because we don't want to treat these fields as keyword fields, because they can store lots and lots of information, and if they're stored as a single term, they will easily pass the limit of 32766 characters, and will cause errors when you try to save them.

[ycombinator]

I wonder if, for the same reason, we should also change the mapping of other index-pattern fields as well as various saved object fields from keyword to text. Specifically, I'm thinking of these fields which were made keyword in #9280 but whose values could get really long:

• fieldFormatMap: https://github.com/elastic/kibana/pull/9280/files#diff-274005236556ec7aa3ebc5475ca54f5bR47
• panelsJSON: https://github.com/elastic/kibana/pull/9280/files#diff-52a7c58f5e1f982720c265076bad855eR53
• optionsJSON: https://github.com/elastic/kibana/pull/9280/files#diff-52a7c58f5e1f982720c265076bad855eR54
• uiStateJSON: https://github.com/elastic/kibana/pull/9280/files#diff-52a7c58f5e1f982720c265076bad855eR55
• uiStateJSON: https://github.com/elastic/kibana/pull/9280/files#diff-2bdb662fef3bbf243324290c8f92f3dbR58
• timelion_sheet: https://github.com/elastic/kibana/pull/9280/files#diff-988d481d37a25c0a82391d9f1fb0ba0eR44
• searchSourceJSON : https://github.com/elastic/kibana/pull/9280/files#diff-81e6169673307c3525e30b9b697fb43bL90

Thoughts, @lukasolson?

[lukasolson]

@ycombinator I agree. I've updated the PR with these changes. Could you take another look?

[ycombinator]

@lukasolson Looks like you missed one:

searchSourceJSON: https://github.com/elastic/kibana/pull/9280/files#diff-81e6169673307c3525e30b9b697fb43bL90

Just kidding. I just noticed f107e96 👅

[ycombinator]

@lukasolson A test needs to be updated:

kibana/src/ui/public/utils/__tests__/mapping_setup.js

Line 25 in d635c11

context('when type is json', function () {

[ycombinator]

Shouldn't this be text?

[lukasolson]

GAH sorry

[ycombinator]

LGTM.

[tsullivan]

Does this fix being able to create an index pattern for a Metricbeat index?

[ycombinator]

@tsullivan Yes it should, assuming you were running into an error like this:

{"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[nij2QMp][127.0.0.1:9300][indices:data/write/index[p]]"}],"type":"illegal_argument_exception","reason":"Document contains at least one immense term in field=\"fields\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped.  Please correct the analyzer to not produce such terms.  The prefix of the first immense term is: '[91, 123, 34, 110, 97, 109, 101, 34, 58, 34, 114, 101, 100, 105, 115, 46, 105, 110, 102, 111, 46, 99, 108, 117, 115, 116, 101, 114, 46, 101]...', original message: bytes can be at most 32766 in length; got 106706","caused_by":{"type":"max_bytes_length_exceeded_exception","reason":"bytes can be at most 32766 in length; got 106706"}},"status":400}

You will, of course, need to DELETE .kibana first.

[tsullivan]

@ycombinator awesome - I confirmed this also fixes index patterns for twitter data 🐔

[tsullivan]

Code changes LGTM but I wouldn't know if there are any other areas that need to be touched.