Keyword vs text

In ES 5.X there are two datatypes that deal with strings: keyword and text. When a new string field arrives, by default elasticsearch will store it both as a string and as a text. This can be a waste of space and memory if only one of the two types are needed. The first one will take the whole field as a single token, whereas the text will split it on every single word. Keywords can be used for aggregations, whereas text cannot. See and

If you want all the strings to be mapped as keywords by default, the easiest solution is to upload a template with a dynamic mapping like

    "template" : "*",
    "mappings" : {
         "_default_" :{ 
            "dynamic_templates": [  {
                "strings": {
                    "match_mapping_type": "string",
                    "mapping": {
                        "type": "keyword",
                        "ignore_above": 256