Configuration in index file to avoid default keyword type generation

Elastic Stack Elasticsearch
1

How to create index file which creates only type text and not type keyword.

2

You can mark the field in the mapping just as a text datatype, see the text datatype documentation

3

Hi ,
my question is how to make all fields in audit index as text because audit-index file always holds text and keyword type for string fields.
so because of this that file size gets larger or double and also two names gets created for 1 field and break audit logs for mismatch fields mapping.

Thanks ,
saraswati

4

you can use the match mapping type within an index template, see https://www.elastic.co/guide/en/elasticsearch/reference/6.4/dynamic-templates.html#match-mapping-type

If this is an index created by one of the beats (auditbeat) I personally would try to not change the mapping unless absolutely necessary.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.