Create custom analyzer in index template

(Cam) #1

Hi All,

I am using Elastic as a logging system, and one of the optimizations I would like to make is changing the 'analyzer' ( for my 'host' field.

I would basically want the 'keyword' analyzer but to be case insensitive (lowercased, might be ok).

I suspect I'd need to write a 'custom' analyzer but I really have no idea how to go about this - is anyone able to help?

(elastic 6.4.2)

(Cam) #2

For anyone interested my full completed example is here: Changing the analyzer type fields are no longer aggregatable