Map fields in Streams

Field mappings define how Elasticsearch stores and indexes your data, balancing storage efficiency against query performance. You can map fields from the Processing tab or the Schema tab.

Mapped versus runtime fields

Unmapped fields can still be searched using runtime fields, but at a higher query cost. Use this table to decide which approach fits your use case:

	Mapped fields	Runtime fields
Query performance	Fast	Slower
Aggregations and sorting	Fully supported	Supported, but slower
Schema changes	Require re-indexing	No re-indexing needed
Best for	Fields you query, filter, or aggregate regularly	Exploratory queries, infrequent lookups, or schema still in flux

For most fields, use mapped fields. The performance benefit outweighs the extra storage for any field you use regularly — especially fields used in dashboards, filters, and aggregations. Use runtime fields when you're still exploring your data structure or for fields you rarely query.

For more background on field types and mapping, refer to the mapping overview.

Map fields from the Processing tab

After you create a processor, open the Detected fields tab to view any fields it extracted. Streams automatically attempts to map these fields so you can use them in queries.

From here, you can:

Accept the suggested field mapping.
Change an incorrect field mapping to the correct type.
Remove the mapping from a field.

Map fields from the Schema tab

The Schema tab provides an overview of how fields are defined within your stream.

Classic streams: the Schema tab lists all fields found in the underlying index or index template. Each field shows its mapping status and type, either Mapped or Unmapped.
Wired streams: The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.2 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. the Schema tab determines field mappings by combining information from the current stream’s index and its parent streams. Fields with a type defined in a parent stream have the Inherited status. You can navigate to that parent stream to view or edit the mapping (except for fields defined in the root logs stream, which you can't modify).

When you add a mapping to a wired stream, all of its child streams automatically inherit it.

Edit mappings from the Schema tab

To edit field mappings from the Schema tab:

Open the Field actions menu by selecting the icon.
Select Map field.
From the Type menu, select the field type.
Select Stage changes to save your updates.