Hello,
I did set a dynamic template to make sure all the string are mapped as keyword but I still see fields stored as text, any hints?
{
"app-security-2017-03-10": {
"mappings": {
"_default_": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"omit_norms": {
"match_mapping_type": "*",
"mapping": {
"norms": {
"enabled": false
}
}
}
},
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"include_in_all": true,
"index": "not_analyzed",
"type": "keyword"
}
}
}
]
},
"app-security-logs": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"omit_norms": {
"match_mapping_type": "*",
"mapping": {
"norms": {
"enabled": false
}
}
}
},
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"include_in_all": true,
"index": "not_analyzed",
"type": "keyword"
}
}
}
],
"properties": {
"eventType": {
"type": "text",
"norms": false
},
"httpMethod": {
"type": "text",
"norms": false
},
"httpStatus": {
"type": "long"
},
"method": {
"type": "text",
"norms": false
},
"nucleus-personaId": {
"type": "text",
"norms": false
},
"nucleus-pid": {
"type": "text",
"norms": false
},
"app-cluster": {
"type": "text",
"norms": false
},
"app-instigator": {
"type": "text",
"norms": false
},
"app-platform": {
"type": "text",
"norms": false
},
"app-sid": {
"type": "text",
"norms": false
},
"app-title": {
"type": "text",
"norms": false
},
"app-traceId": {
"type": "text",
"norms": false
},
"request": {
"type": "text",
"norms": false
},
"requestHeaders": {
"properties": {
"Accept": {
"type": "text",
"norms": false
},
"Accept-Encoding": {
"type": "text",
"norms": false
},
"Accept-Language": {
"type": "text",
"norms": false
},
"Cache-Control": {
"type": "text",
"norms": false
},
"Connection": {
"type": "text",
"norms": false
},
"Content-Length": {
"type": "text",
"norms": false
},
"Content-Type": {
"type": "text",
"norms": false
},
"Cookie": {
"type": "text",
"norms": false
},
"Host": {
"type": "text",
"norms": false
},
"Origin": {
"type": "text",
"norms": false
},
"Postman-Token": {
"type": "text",
"norms": false
},
"Referer": {
"type": "text",
"norms": false
},
"User-Agent": {
"type": "text",
"norms": false
},
"X-BOS-Instigator": {
"type": "text",
"norms": false
},
"X-BOS-Trace-Id": {
"type": "text",
"norms": false
},
"X-Forwarded-For": {
"type": "text",
"norms": false
},
"X-Forwarded-Port": {
"type": "text",
"norms": false
},
"X-Forwarded-Proto": {
"type": "text",
"norms": false
},
"X-app-SID": {
"type": "text",
"norms": false
},
"X-app-Tool-Requestor": {
"type": "text",
"norms": false
},
"X-app-Version": {
"type": "text",
"norms": false
},
"X-Requested-With": {
"type": "text",
"norms": false
}
}
},
"response": {
"type": "text",
"norms": false
},
"responseHeaders": {
"properties": {
"Access-Control-Allow-Credentials": {
"type": "text",
"norms": false
},
"Access-Control-Allow-Headers": {
"type": "text",
"norms": false
},
"Access-Control-Allow-Methods": {
"type": "text",
"norms": false
},
"Access-Control-Allow-Origin": {
"type": "text",
"norms": false
},
"Access-Control-Max-Age": {
"type": "text",
"norms": false
},
"Content-Type": {
"type": "text",
"norms": false
},
"X-app-SID": {
"type": "text",
"norms": false
}
}
},
"responseLength": {
"type": "long"
},
"restCall": {
"type": "text",
"norms": false
},
"restHost": {
"type": "text",
"norms": false
},
"time": {
"type": "date"
},
"timeMs": {
"type": "float"
},
"timestampEnd": {
"type": "long"
},
"timestampStart": {
"type": "long"
},
"to": {
"type": "text",
"norms": false
},
"uri": {
"type": "text",
"norms": false
}
}
}
}
}
}