|
1 | 1 | ---
|
2 |
| -navigation_title: Manage field mapping |
| 2 | +navigation_title: Map fields |
3 | 3 | applies_to:
|
4 | 4 | serverless: ga
|
5 | 5 | stack: preview 9.1, ga 9.2
|
6 | 6 | ---
|
7 | 7 |
|
8 |
| -# Manage field mapping using the Schema tab [streams-schema] |
| 8 | +# Map fields [streams-schema] |
9 | 9 |
|
10 |
| -## Permissions to edit and add fields [streams-schema-permissions] |
| 10 | +Mappings define how {{es}} stores and indexes your data, balancing storage efficiency against query capability and performance. |
11 | 11 |
|
12 |
| -## Field statuses [streams-schema-statuses] |
| 12 | +Unmapped fields can still be searched using [runtime fields](../../../../manage-data/data-store/mapping/runtime-fields.md), but these incur higher query costs. Runtime fields are useful for exploring your data and experimenting with different query types before finalizing a schema. |
| 13 | + |
| 14 | +Once you know which fields you query most often, you can map them to improve performance, at the cost of additional storage. For a general overview, refer to the [Mapping](../../../../manage-data/data-store/mapping.md) documentation. |
| 15 | + |
| 16 | +Streams gives you options for mapping fields and editing field mappings, either after creating a processor or from the **Schema** tab. |
| 17 | + |
| 18 | +## Processing tab |
| 19 | + |
| 20 | +After creating a [processor](./extract.md), open the **Detected fields** tab to find any fields that the processor has extracted. Streams automatically attempts to map these fields so you can use them in queries. |
| 21 | + |
| 22 | +From here, you can: |
| 23 | + |
| 24 | +- Accept the suggested field mapping. |
| 25 | +- Change the field mapping to a different type. |
| 26 | +- Remove the mapping from these fields. |
| 27 | + |
| 28 | +## Schema tab |
| 29 | + |
| 30 | +The **Schema** tab provides an overview of how fields are defined within your stream. |
| 31 | + |
| 32 | +**Classic streams:** the **Schema** tab lists all fields found in the underlying index or index template. Each field shows its mapping status and type. Fields are labelled with either a **Mapped** or **Unmapped** status accordingly. |
| 33 | + |
| 34 | +**Wired streams:** :applies_to: {"stack": "preview 9.2", "serverless": "preview"} the **Schema** tab determines field mappings by combining information from the current stream’s index and its parent streams. Fields whose type is defined in a parent stream have the status of **Inherited**. You can navigate to that parent stream to view or edit the mapping (except for fields defined in the root logs stream, which cannot be modified). |
| 35 | + |
| 36 | +When you add a mapping to a wired stream, its child streams inherit the mapping. |
| 37 | + |
| 38 | +### Edit mappings from the Schema tab |
| 39 | + |
| 40 | +To edit field mappings from the **Schema** tab: |
| 41 | +1. Open the **Field actions** menu by selecting the {icon}`boxes_vertical` icon. |
| 42 | +1. Select **Map field** |
| 43 | +1. From the **Type** dropdown, select the desired field type. |
| 44 | +1. Select **Stage changes**. |
| 45 | + |
| 46 | +% need to add permissions ## Permissions to edit and add fields [streams-schema-permissions] |
0 commit comments