Change the default mapping


(Krishna Moorthy) #1

Hi,

my current mapping looks like this,

{
"threatfeedsone" : {
"mappings" : {
"IPv4" : {
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
"@version" : {
"type" : "string"
},
"direction" : {
"type" : "string"
},
"entity" : {
"type" : "string"
},
"geoip" : {
"properties" : {
"area_code" : {
"type" : "long"
},
"city_name" : {
"type" : "string"
},
"continent_code" : {
"type" : "string"
},
"country_code2" : {
"type" : "string"
},
"country_code3" : {
"type" : "string"
},
"country_name" : {
"type" : "string"
},
"dma_code" : {
"type" : "long"
},
"ip" : {
"type" : "string"
},
"latitude" : {
"type" : "double"
},
"location" : {
"type" : "double"
},
"longitude" : {
"type" : "double"
},
"postal_code" : {
"type" : "string"
},
"real_region_name" : {
"type" : "string"
},
"region_name" : {
"type" : "string"
},
"timezone" : {
"type" : "string"
}
}
},
"host" : {
"type" : "string"
},
"message" : {
"type" : "string"
},
"path" : {
"type" : "string"
},
"source" : {
"type" : "string"
},
"type" : {
"type" : "string"
}
}
}
}
}
}

Please let me know how to change the geo location to geo_point instead of double


(Magnus Bäck) #2

First of all, you'll have to create a new index with the updated mappings and reindex your data there.

Take these mappings, edit them as necessary, and pass them as the settings of the new index when using the index creation API call or issue a subsequent mapping put call. Finally reindex your data into the new index.


(Mark Walkom) #3

I'd change a fair bit in that mapping, why do you have postcode as a string for eg, shouldn't that be a number?


(Magnus Bäck) #4

I'd change a fair bit in that mapping, why do you have postcode as a string for eg, shouldn't that be a number?

Perhaps, but the postcode of many countries (e.g. UK and Sweden) include letters and/or spaces.


(Isabel Drost-Fromm) #5

Or worse as that usually fails silently as in the local post office later has to resolve the address manually: Leading zeros (e.g. Germany).


(Jörg Prante) #6

Yes, it's not that simple, there are postcodes composed of components, like routing key and unique ID and checksum, like the Eircode in Ireland :smile:


(Ivan Brusic) #7

Leading zeros in the US as well


(Isabel Drost-Fromm) #8

That is weird: I once got a package from a US based company that was missing the leading zero in my postal code. As a result I thought the US don't have this issue - but if it's the same there, I'm wondering who implemented the form I filled in back then. :wink:


(Ivan Brusic) #9

The US has its fair share of bad web developers. Are there none were you
are? I must move there at once! :slight_smile:

Ivan


(Mark Walkom) #10

Oh! Move to AU, we don't have that issue :wink:


(system) #11