Get index field mapping
index_mappingRead-only
Inspect an index's field mapping to see every field name and its OpenSearch type before writing a DSL query.
Instructions
Return one index's field mapping: every field name and its OpenSearch type.
Use this to learn what fields an index holds and how they are typed before
writing a DSL query against it. To list which indices exist rather than inspect
one index's schema, use list_indices. For Malcolm's non-standard field names
across all indices, malcolm_field_search is easier than reading raw mappings.
Returns the raw OpenSearch _mapping response; a non-existent index yields an
OpenSearch error in the response body.
A wildcard returns one mapping block per matching index rather than a
merged one, and each block repeats the whole schema: "arkime_sessions3-*"
costs roughly a megabyte of JSON, growing by another block every day
Arkime opens a new index. Name ONE index when you only need the schema —
the blocks are near-identical. The types it reports are OpenSearch's own
(keyword, long, text), while malcolm_field_search reports Malcolm's names
for the same fields (string, integer) — so come here only when the
OpenSearch type is what you need.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Exact index name or pattern to fetch the mapping for, e.g. "arkime_sessions3-*". Accepts a wildcard. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |