Custom analyzers in Packetbeat index template

Elastic Stack Beats
,
1

Hi,
I recently started using Packetbeat and started adding my own fields to the index template (using the setup.template.append_fields).
I was wondering if there is some way to create a custom analyzer for my custom text fields in Packetbeat?
My specific use-case is creating a custom "domain name" analyzer for the dns.question.name field (which I recreated as a text field under a different name). The analyzer I thought of using is something like this: Hostname analyzer · Issue #44833 · elastic/elasticsearch · GitHub

I tried adding it like so, but the analyzer wasn't recognized:

setup.template.settings:
  analysis:
    tokenizer:
...

Any ideas?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.