Why dynamic field is added even though dynamic is set to strict in elasticsearch?

Question

I have set dynamic property to "strict" for my fields. But when I update using POST _update api, a dynamic field is added.

Mapping is as follows:

{
    "dynamic": "strict",
    "properties": {
        "title": {
             "type": "keyword"
         },
         "track": {
             "properties": {
                  "date": {
                     "type": "date"
                  }
              }
          }
    }
}

POST _update query :

{
    "doc": {
        "track.date": "2004-08-14"
    }
}

Result:

{
   "title": "some-title",
   "track": {
        "date" : "2020-04-12:00:00:00"
    },
    "track.date":"2004-08-14"
}

Why is the new field "track.date" created? Shouldn't the POST update give an error instead of updating the above field?

Answer 1

I believe dynamic mapping only affects new fields, not updates. So i'd say this is the expected behaviour : track.date is a valid field present in the indice's mapping, so nothing crashes.

Edit : i could not find any way to explicitly prevent document updates, but you can disable the _source field, which will, as a side-effect, disable document updates. Please read the docs before doing so, though.

Edit 2: I have created a new topic on the forums to confirm this is a bug.

It seems that elasticsearch considers"field1.field2": "12" and

"field1": {
   "field2": "12"
}

to have the exact same mapping. The query :

PUT /test2
{
   "mappings": {
      "dynamic": "strict",
      "properties": {
         "field1.field2": {"type": "text"}
      }
   }
}

Creates an indice with the following mapping (query'd via GET /test2/_mappings) :

{
   "test2": {
      "mappings": {
         "dynamic": "strict",
         "properties": {
            "field1": {
               "properties": {
                  "field2": {
                     "type": "text"
}}}}}}} // collapsed

But updating (and/or) indexing documents treats both syntax differently :

POST /test2/_doc/0
{
   "doc": {
      "field1": {
         "field2": "0"
}}}

yields (query'd via GET test2/_search): "field1": {"field2":"0"}

whereas

POST /test2/_doc/0
{
   "doc": {
      "field1.field2": "1"
}}

yields "field1.field2": "1"