Dynamic index template: ignoring fields by regex pattern

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.17.1

Describe the issue:
We use a dynamic index template to we manage our indices, indices are daily indices.
We have an object model that contains something similar to

{
    "TransactionId": "dedd035c-e51d-4b5f-ad02-a65123404a5c",
    "Event": "Purchase",
    "Time": 1732295828717,
    "AffectedEntity1": {
      "Type": "Product",
      "Id": "18210",
      "Name": "License"
  },
  "AffectedEntity2": {
    "Type": "Creator",
    "Id": "280659",
    "Name": "Jimmy"
  },
  "AffectedEntity3": {
    "Type": "SalesRegion",
    "Id": "280659",
    "Name": "EMEA"
  }
...

This is ficticious and so please do not ask about the data itself :slight_smile:

The number of of these AffectedEntity objects may grow. We had a few instances of 500+ (i.e. AffectedEntity500.Id ) of these and each instance requires 3 fields and so we get the max field for a mapping error.

We have managed this with increasing the field mapping or making changes to the source data, but we still have a few we cannot change.

I have been thinking about ways to manage this with the mapping, the “enabled” seems like a good start, I can set some static mappings like:

   "mappings": {
      "properties": {
        "AffectedEntity2": { "type": "object", "enabled": false },
        "AffectedEntity3": { "type": "object", "enabled": false },
....
        "AffectedEntity500": { "type": "object", "enabled": false }
     },
      "dynamic_templates": [
        {
....

but then i would have to define each object, like have 500 lines of enabled: false, and that looks like i am doing something wrong.

Most users in dashboards only ever search for one of the first couple of entities. My goal is to basically have something where I ignore for indexing, but store, objects from 10 onward. So I thought lets ignore from object 10 onward

My issue:
I have not been able to find any way to use the regex path_match to be able to say “enabled”: “false” so that I do not explicitly define 500 mappings to set “enabled”: “false”.

One way I kinda worked around this was to use a dynamic template to map the Object field to a “text” and have “ignore_malformed”: true. This ends up using a field still instead of 3…