[BUG] Missing mapping for top_queries index "source" field #411
Description
What is the bug?
The Query Insights local index is missing a mapping for the source field. OpenSearch applies dynamic mapping to fields without explicit mappings. However, because the source field in the local index can be very large and deeply nested, this may lead to errors such as IllegalArgumentException and MapperParsingException, as shown below:
java.lang.IllegalArgumentException: Limit of total fields [1000] has been exceeded
MapperParsingException[failed to parse]; nested: OpenSearchParseException[The depth of the field has exceeded the allowed limit of [20]. This limit can be set by changing the [index.mapping.depth.limit] index level setting.];
Sample mapping for top_queries-2025.09.05-00381. See source mapping is highly bloated.
{
"top_queries-2025.09.05-00381" : {
"mappings" : {
"dynamic" : "true",
"_meta" : {
"schema_version" : 1,
"query_insights_feature_space" : "top_n_queries"
},
"properties" : {
"group_by" : {...},
"id" : {...},
"indices" : {...},
"labels" : {...},
"measurements" : {...},
"node_id" : {...},
"phase_latency_map" : {...},
"search_type" : {...},
"source" : {
"properties" : {
"query" : {
"properties" : {
"match" : {
"properties" : {
"author" : {
"properties" : {
"auto_generate_synonyms_phrase_query" : {
"type" : "boolean"
},
"boost" : {
"type" : "float"
},
"fuzzy_transpositions" : {
"type" : "boolean"
},
"lenient" : {
"type" : "boolean"
},
"max_expansions" : {
"type" : "long"
},
"operator" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"prefix_length" : {
"type" : "long"
},
"query" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"zero_terms_query" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
},
"content" : {
"properties" : {
"auto_generate_synonyms_phrase_query" : {
"type" : "boolean"
},
"boost" : {
"type" : "float"
},
"fuzzy_transpositions" : {
"type" : "boolean"
},
"lenient" : {
"type" : "boolean"
},
"max_expansions" : {
"type" : "long"
},
"operator" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"prefix_length" : {
"type" : "long"
},
"query" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"zero_terms_query" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
},
"match_all" : {
"properties" : {
"boost" : {
"type" : "float"
}
}
}
}
}
}
},
"task_resource_usages" : {...},
"timestamp" : {...},
"top_n_query" : {...},
"total_shards" : {...}
}
}
}
}
How can one reproduce the bug?
Steps to reproduce the behavior.
What is the expected behavior?
A clear and concise description of what you expected to happen.
What is your host/environment?
Operating system, version.
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
Add any other context about the problem.