Regex Pattern Field Names

Jozef Soročin

Updated 07/13/2025

Use Case

My document contains

various date-time fields names *Time and *At — shipmentTime, createdAt etc.
boolean fields of the form is_* — is_premium, is_company etc.
other fields that I all want to declare as keywords.

How can I auto-generate mappings for these 3 field varieties?

Approach

You already know you should be utilizing match_mapping_type along with match and/or unmatch so you may be tempted to use

PUT myindex
{
  "mappings": {
    "dynamic_templates": [
      {
        "justKeywords": {
          "match_mapping_type": "*",
		  "unmatch": [
			"*Time",
            "*At",
            "is_*"
           ],
          "mapping": {
            "type": "keyword"
          }
        }
      },
      ...
    ]
  }
}

That's not going to work because unmatch can only be a pattern string, not an array thereof.

Use match instead and order the templates from the most specific restriction to the least:

PUT myindex
{
  "mappings": {
	  "dynamic_templates": [
	    {
	      "timeSuffix": {
	        "match_mapping_type": "*",
	        "match_pattern": "regex",
	        "match": "^(.*Time)|(.*At)$",
	        "mapping": {
	          "type": "date",
            "format": "yyyy-MM-dd HH:mm:ss"
	        }
	      }
	    },
	    {
	      "isPrefix": {
	        "match_mapping_type": "*",
	        "match": "is_*",
	        "mapping": {
	          "type": "boolean"
	        }
	      }
	    },
	    {
	      "justKeywords": {
	        "match_mapping_type": "*",
	        "mapping": {
	          "type": "keyword"
	        }
	      }
	    }
	  ]
	}
}

Remarks

timeSuffix is defined by an actual regex so you'll need to specify "match_pattern": "regex" in order to support full Java regular expression syntax.

In contrast, isPrefix is a simple wildcard pattern that doesn't require any more config.

Links

The official documentation is available here .