Configuration in index file to avoid default keyword type generation

(saraswati) #1

How to create index file which creates only type text and not type keyword.

(Alexander Reelsen) #2

You can mark the field in the mapping just as a text datatype, see the text datatype documentation

(saraswati) #3

Hi ,
my question is how to make all fields in audit index as text because audit-index file always holds text and keyword type for string fields.
so because of this that file size gets larger or double and also two names gets created for 1 field and break audit logs for mismatch fields mapping.

Thanks ,

(Alexander Reelsen) #4

you can use the match mapping type within an index template, see

If this is an index created by one of the beats (auditbeat) I personally would try to not change the mapping unless absolutely necessary.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.