_default_ string to keyword but fields still using text

Elastic Stack Elasticsearch
1

Hello,

I did set a dynamic template to make sure all the string are mapped as keyword but I still see fields stored as text, any hints?

{
"app-security-2017-03-10": {
	"mappings": {
		"_default_": {
			"_all": {
				"enabled": true,
				"norms": false
			},
			"dynamic_templates": [
				{
					"omit_norms": {
						"match_mapping_type": "*",
						"mapping": {
							"norms": {
								"enabled": false
							}
						}
					}
				},
				{
					"strings_as_keyword": {
						"match_mapping_type": "string",
						"mapping": {
							"include_in_all": true,
							"index": "not_analyzed",
							"type": "keyword"
						}
					}
				}
			]
		},
		"app-security-logs": {
			"_all": {
				"enabled": true,
				"norms": false
			},
			"dynamic_templates": [
				{
					"omit_norms": {
						"match_mapping_type": "*",
						"mapping": {
							"norms": {
								"enabled": false
							}
						}
					}
				},
				{
					"strings_as_keyword": {
						"match_mapping_type": "string",
						"mapping": {
							"include_in_all": true,
							"index": "not_analyzed",
							"type": "keyword"
						}
					}
				}
			],
			"properties": {
				"eventType": {
					"type": "text",
					"norms": false
				},
				"httpMethod": {
					"type": "text",
					"norms": false
				},
				"httpStatus": {
					"type": "long"
				},
				"method": {
					"type": "text",
					"norms": false
				},
				"nucleus-personaId": {
					"type": "text",
					"norms": false
				},
				"nucleus-pid": {
					"type": "text",
					"norms": false
				},
				"app-cluster": {
					"type": "text",
					"norms": false
				},
				"app-instigator": {
					"type": "text",
					"norms": false
				},
				"app-platform": {
					"type": "text",
					"norms": false
				},
				"app-sid": {
					"type": "text",
					"norms": false
				},
				"app-title": {
					"type": "text",
					"norms": false
				},
				"app-traceId": {
					"type": "text",
					"norms": false
				},
				"request": {
					"type": "text",
					"norms": false
				},
				"requestHeaders": {
					"properties": {
						"Accept": {
							"type": "text",
							"norms": false
						},
						"Accept-Encoding": {
							"type": "text",
							"norms": false
						},
						"Accept-Language": {
							"type": "text",
							"norms": false
						},
						"Cache-Control": {
							"type": "text",
							"norms": false
						},
						"Connection": {
							"type": "text",
							"norms": false
						},
						"Content-Length": {
							"type": "text",
							"norms": false
						},
						"Content-Type": {
							"type": "text",
							"norms": false
						},
						"Cookie": {
							"type": "text",
							"norms": false
						},
						"Host": {
							"type": "text",
							"norms": false
						},
						"Origin": {
							"type": "text",
							"norms": false
						},
						"Postman-Token": {
							"type": "text",
							"norms": false
						},
						"Referer": {
							"type": "text",
							"norms": false
						},
						"User-Agent": {
							"type": "text",
							"norms": false
						},
						"X-BOS-Instigator": {
							"type": "text",
							"norms": false
						},
						"X-BOS-Trace-Id": {
							"type": "text",
							"norms": false
						},
						"X-Forwarded-For": {
							"type": "text",
							"norms": false
						},
						"X-Forwarded-Port": {
							"type": "text",
							"norms": false
						},
						"X-Forwarded-Proto": {
							"type": "text",
							"norms": false
						},
						"X-app-SID": {
							"type": "text",
							"norms": false
						},
						"X-app-Tool-Requestor": {
							"type": "text",
							"norms": false
						},
						"X-app-Version": {
							"type": "text",
							"norms": false
						},
						"X-Requested-With": {
							"type": "text",
							"norms": false
						}
					}
				},
				"response": {
					"type": "text",
					"norms": false
				},
				"responseHeaders": {
					"properties": {
						"Access-Control-Allow-Credentials": {
							"type": "text",
							"norms": false
						},
						"Access-Control-Allow-Headers": {
							"type": "text",
							"norms": false
						},
						"Access-Control-Allow-Methods": {
							"type": "text",
							"norms": false
						},
						"Access-Control-Allow-Origin": {
							"type": "text",
							"norms": false
						},
						"Access-Control-Max-Age": {
							"type": "text",
							"norms": false
						},
						"Content-Type": {
							"type": "text",
							"norms": false
						},
						"X-app-SID": {
							"type": "text",
							"norms": false
						}
					}
				},
				"responseLength": {
					"type": "long"
				},
				"restCall": {
					"type": "text",
					"norms": false
				},
				"restHost": {
					"type": "text",
					"norms": false
				},
				"time": {
					"type": "date"
				},
				"timeMs": {
					"type": "float"
				},
				"timestampEnd": {
					"type": "long"
				},
				"timestampStart": {
					"type": "long"
				},
				"to": {
					"type": "text",
					"norms": false
				},
				"uri": {
					"type": "text",
					"norms": false
				}
			}
		}
	}
}

}

2

Hey,

can you please provide a fully reproducible example, including index creation/mapping and a document that contains an unwanted field?

--Alex

3

Hmm well index are created automatically, but I might be missing something here, I just don't understand why:

"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"include_in_all": true,
"index": "not_analyzed",
"type": "keyword"
}

is not picked up on any string fields? Do you see something wrong in the template?

Thank you,