|
| 1 | +--- |
| 2 | +navigation_title: "Pattern Text" |
| 3 | +mapped_pages: |
| 4 | + - https://www.elastic.co/guide/en/elasticsearch/reference/current/pattern-text.html |
| 5 | +--- |
| 6 | + |
| 7 | +## Pattern text field type [pattern-text-field-type] |
| 8 | +```{applies_to} |
| 9 | +serverless: preview |
| 10 | +stack: preview 9.2 |
| 11 | +``` |
| 12 | +:::{note} |
| 13 | +This feature requires a [subscription](https://www.elastic.co/subscriptions). |
| 14 | +::: |
| 15 | + |
| 16 | +The `pattern_text` field type is a variant of [`text`](#text-field-type) with improved space efficiency for log data. |
| 17 | +Internally, it decomposes values into static parts that are likely to be shared among many values, and dynamic parts that tend to vary. |
| 18 | +The static parts usually come from the explanatory text of a log message, while the dynamic parts are the variables that were interpolated into the logs. |
| 19 | +This decomposition allows for improved compression on log-like data. |
| 20 | + |
| 21 | +We call the static portion of the value the `template`. |
| 22 | +Although the template cannot be accessed directly, a separate field called `<field_name>.template_id` is accessible. |
| 23 | +This field is a hash of the template and can be used to group similar values. |
| 24 | + |
| 25 | +Analysis is configurable but defaults to a delimiter-based analyzer. |
| 26 | +This analyzer applies a lowercase filter and then splits on whitespace and the following delimiters: `=`, `?`, `:`, `[`, `]`, `{`, `}`, `"`, `\`, `'`. |
| 27 | + |
| 28 | +## Limitations |
| 29 | + |
| 30 | +Unlike most mapping types, `pattern_text` does not support multiple values for a given field per document. |
| 31 | +If a document is created with multiple values for a pattern_text field, an error will be returned. |
| 32 | + |
| 33 | +[span queries](/reference/query-languages/query-dsl/span-queries.md) are not supported with this field, use [interval queries](/reference/query-languages/query-dsl/query-dsl-intervals-query.md) instead, or the [`text`](#text-field-type) field type if you absolutely need span queries. |
| 34 | + |
| 35 | +Like `text`, `pattern_text` does not support sorting and has only limited support for aggregations. |
| 36 | + |
| 37 | +## Phrase matching |
| 38 | +Pattern text supports an `index_options` parameter with valid values of `docs` and `positions`. |
| 39 | +The default value is `docs`, which makes `pattern_text` behave similarly to `match_only_text` for phrase queries. |
| 40 | +Specifically, positions are not stored, which reduces the index size at the cost of slowing down phrase queries. |
| 41 | +If `index_options` is set to `positions`, positions are stored and `pattern_text` will support fast phrase queries. |
| 42 | +In both cases, all queries return a constant score of 1.0. |
| 43 | + |
| 44 | +## Index sorting for improved compression |
| 45 | +The compression provided by `pattern_text` can be significantly improved if the index is sorted by the `template_id` field. |
| 46 | +For example, a typical approach would be to sort first by `message.template_id`, then by `@timestamp`, as shown in the following example. |
| 47 | + |
| 48 | +```console |
| 49 | +PUT logs |
| 50 | +{ |
| 51 | + "settings": { |
| 52 | + "index": { |
| 53 | + "sort.field": [ "message.template_id", "@timestamp" ], |
| 54 | + "sort.order": [ "asc", "desc" ] |
| 55 | + } |
| 56 | + }, |
| 57 | + "mappings": { |
| 58 | + "properties": { |
| 59 | + "@timestamp": { |
| 60 | + "type": "date" |
| 61 | + }, |
| 62 | + "message": { |
| 63 | + "type": "pattern_text" |
| 64 | + } |
| 65 | + } |
| 66 | + } |
| 67 | +} |
| 68 | +``` |
| 69 | + |
| 70 | + |
| 71 | +## Parameters for pattern text fields [pattern-text-params] |
| 72 | + |
| 73 | +The following mapping parameters are accepted: |
| 74 | + |
| 75 | +[`analyzer`](/reference/elasticsearch/mapping-reference/analyzer.md) |
| 76 | +: The [analyzer](docs-content://manage-data/data-store/text-analysis.md) which should be used for the `pattern_text` field, both at index-time and at search-time (unless overridden by the [`search_analyzer`](/reference/elasticsearch/mapping-reference/search-analyzer.md)). |
| 77 | +Supports a delimiter-based analyzer and the standard analyzer, as is used in `match_only_text` mappings. |
| 78 | +Defaults to the delimiter-based analyzer, which applies a lowercase filter and then splits on whitespace and the following delimiters: `=`, `?`, `:`, `[`, `]`, `{`, `}`, `"`, `\`, `'`. |
| 79 | + |
| 80 | +[`index_options`](/reference/elasticsearch/mapping-reference/index-options.md) |
| 81 | +: What information should be stored in the index, for search and highlighting purposes. Valid values are `docs` and `positions`. Defaults to `docs`. |
| 82 | + |
| 83 | +[`meta`](/reference/elasticsearch/mapping-reference/mapping-field-meta.md) |
| 84 | +: Metadata about the field. |
| 85 | + |
0 commit comments