Hi everybody,
We're gonna use logstash + elasticsearch to store logs.
Indexes gonna be created as "name-%{+YYYY.MM}". I have custom mapping for log type.
Do I have to create mapping for type before creating index every new month, or there is easer way to map type only once and use the same type within every new index ?
Hello,
I think the best thing to do is to create an index template.
You set your mapping once and it will be applied each time a new index is created.
https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html
Antoine
1 Like
Yeah! Thank you, I am already looking to that.