Configuration in index file to avoid default keyword type generation


(saraswati) #1

How to create index file which creates only type text and not type keyword.


(Alexander Reelsen) #2

You can mark the field in the mapping just as a text datatype, see the text datatype documentation


(saraswati) #3

Hi ,
my question is how to make all fields in audit index as text because audit-index file always holds text and keyword type for string fields.
so because of this that file size gets larger or double and also two names gets created for 1 field and break audit logs for mismatch fields mapping.

Thanks ,
saraswati


(Alexander Reelsen) #4

you can use the match mapping type within an index template, see https://www.elastic.co/guide/en/elasticsearch/reference/6.4/dynamic-templates.html#match-mapping-type

If this is an index created by one of the beats (auditbeat) I personally would try to not change the mapping unless absolutely necessary.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.