Change Mapping for Field for ALL OF LOGSTASH Created indexes

Elastic Stack Elasticsearch
1

I would like to change the type of the field location to geo_point. I'm using ES with Logstash, as y'all know, indices are generated with the name logstash-yyyy-mm-dd

I first created a logstash index and named it logstash-2016-03-29, like so:

curl -XPUT 'http://localhost:9200/logstash-2016-03-29'

then, I changed the mapping for supposedly all the indices called Logstash-* using the following:

curl -XPOST "http://localhost:9200/logstash-*/_mapping/logs" -d '{
"properties" : {
            "location" : { "type":"geo_point" }
        }
}'

And when I ran the Logstash configuration file, all the location fields in the index logstash-2016-03-29 were indeed of type geo_point.

However, today, the auto-generated index logstash-2016-03-30 had field location of type String instead of geo_point. I thought the type should be applied on ANY index that starts with the namelogstash-*. Apparently, I was wrong. How can I fix this so that any future index created by logstash that have the location field would have that field type set to geo_point instead of String?

Thanks.

2

To update the mappings that new indexes get, update the index template. By default Logstash's elasticsearch output manages it for you. See that plugin's options.

3

I read about it, but I'm not exactly sure how it's used. Just setting it to false will stop the auto setting of templates for the rest of the newly created logstash indexes and copy the mapping of the first logstash-yyy-mm-dd to the rest of logstash-*?

4

I read about it, but I'm not exactly sure how it's used. Just setting it to false will stop the auto setting of templates for the rest of the newly created logstash indexes and copy the mapping of the first logstash-yyy-mm-dd to the rest of logstash-*?

5

Disabling manage_template means that you'll be responsible for keeping the desired index template up to date. Another option is to keep manage_template enabled but point Logstash to a file where you keep your index template.