Map fields in Streams

Field mappings define how Elasticsearch stores and indexes your data, balancing storage efficiency against query performance. You can map fields from the Processing tab or the Schema tab.

Unmapped fields can still be searched using runtime fields, but at a higher query cost. Use this table to decide which approach fits your use case:

For most fields, use mapped fields. The performance benefit outweighs the extra storage for any field you use regularly — especially fields used in dashboards, filters, and aggregations. Use runtime fields when you're still exploring your data structure or for fields you rarely query.

For more background on field types and mapping, refer to the mapping overview.

After you create a processor, open the Detected fields tab to view any fields it extracted. Streams automatically attempts to map these fields so you can use them in queries.

From here, you can:

• Accept the suggested field mapping.
• Change an incorrect field mapping to the correct type.
• Remove the mapping from a field.

The Schema tab provides an overview of how fields are defined within your stream.

• Classic streams: the Schema tab lists all fields found in the underlying index or index template. Each field shows its mapping status and type, either Mapped or Unmapped.

• Wired streams: the Schema tab determines field mappings by combining information from the current stream’s index and its parent streams. Fields with a type defined in a parent stream have the Inherited status. You can navigate to that parent stream to view or edit the mapping (except for fields defined in the root logs stream, which you can't modify).

  When you add a mapping to a wired stream, all of its child streams automatically inherit it.

To edit field mappings from the Schema tab:

1. Open the Field actions menu by selecting the icon.
2. Select Map field.
3. From the Type menu, select the field type.
4. Select Stage changes to save your updates.