I recently started using Packetbeat and started adding my own fields to the index template (using the setup.template.append_fields).
I was wondering if there is some way to create a custom analyzer for my custom text fields in Packetbeat?
My specific use-case is creating a custom "domain name" analyzer for the dns.question.name field (which I recreated as a text field under a different name). The analyzer I thought of using is something like this: Hostname analyzer · Issue #44833 · elastic/elasticsearch · GitHub
I tried adding it like so, but the analyzer wasn't recognized:
setup.template.settings: analysis: tokenizer: ...