Update_mapping (dynamic) showing up in log

Elastic Stack Elasticsearch
1

HI,

I have Logstash feeding Elasticsearch 0.90.2. I start off ES server with
this custom https://gist.github.com/anonymous/5955942 template for
logstash's logs.
When logs come in I see the below in ES's log file:

[2013-07-09 04:34:48,241][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [postfix] (dynamic)
[2013-07-09 04:35:40,518][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [bind] (dynamic)
[2013-07-09 04:41:16,725][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [syslog] (dynamic)

(postfix,bind and syslog correspond to 'type' being set for each log file
when they were shipped from source server by another logstash application)

Does this 'update_mapping' message imply that it is overriding the default
mappings which was set via the custom template?

Re,

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

It means that new fields that you did not define previously appear in your doc.
Therefore, es needs to update the mapping.

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 9 juil. 2013 à 11:31, subin ksubins321@gmail.com a écrit :

HI,

I have Logstash feeding Elasticsearch 0.90.2. I start off ES server with this custom template for logstash's logs.
When logs come in I see the below in ES's log file:

[2013-07-09 04:34:48,241][INFO ][cluster.metadata ] [Logstash] [logstash-2013.07.09] update_mapping [postfix] (dynamic)
[2013-07-09 04:35:40,518][INFO ][cluster.metadata ] [Logstash] [logstash-2013.07.09] update_mapping [bind] (dynamic)
[2013-07-09 04:41:16,725][INFO ][cluster.metadata ] [Logstash] [logstash-2013.07.09] update_mapping [syslog] (dynamic)

(postfix,bind and syslog correspond to 'type' being set for each log file when they were shipped from source server by another logstash application)

Does this 'update_mapping' message imply that it is overriding the default mappings which was set via the custom template?

Re,

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Thanks for clearing it David.

Re,

On Tue, Jul 9, 2013 at 3:54 PM, David Pilato david@pilato.fr wrote:

It means that new fields that you did not define previously appear in your
doc.
Therefore, es needs to update the mapping.

--
David :wink:
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs

Le 9 juil. 2013 à 11:31, subin ksubins321@gmail.com a écrit :

HI,

I have Logstash feeding Elasticsearch 0.90.2. I start off ES server with
this custom https://gist.github.com/anonymous/5955942 template for
logstash's logs.
When logs come in I see the below in ES's log file:

[2013-07-09 04:34:48,241][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [postfix] (dynamic)
[2013-07-09 04:35:40,518][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [bind] (dynamic)
[2013-07-09 04:41:16,725][INFO ][cluster.metadata ] [Logstash]
[logstash-2013.07.09] update_mapping [syslog] (dynamic)

(postfix,bind and syslog correspond to 'type' being set for each log file
when they were shipped from source server by another logstash application)

Does this 'update_mapping' message imply that it is overriding the default
mappings which was set via the custom template?

Re,

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/SB9lhnpWd0E/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.