How can I create a date based index using sense?
Here is what I usually do:
PUT /member_history/
{
"mappings": {
"ats_member_history": {
"dynamic_templates": [
{ "notanalyzed": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "string",
"index": "not_analyzed"
}
}
}
]
}
}
}
I tried this, but I get naming exception:
PUT /member_history-*/
{
.......
And this definitely doesn't work:
PUT /member_history-[YYYY.MM.dd]/
{
......
warkolm
(Mark Walkom)
May 2, 2016, 9:01pm
2
When something like Logstash does it, it passes in the actual date. You need to do the same, it can't figure it out automatically.
It might be a worthy FR though!
When I do this, my index keeps getting renamed to logstash-YYYY.MM.dd (today that would be 2016.05.03).
I am at least able to get raw fields.
My JSON template
> {
> "template": "member_type_history_template",
> "mappings": {
> "string_fields": {
> "match": "*",
> "match_mapping_type": "string",
> "mapping": {
> "type": "string",
> "index": "not_analyzed"
> }
> }
> }
> }
My logstash output:
output{
elasticsearch {
#index=>"member_type_history-%{+YYYY.MM.dd}"
hosts => ["localhost:9200"]
template => "/home/ubuntu/template/member_type_history_template.json"
template_name => "member_type_history_template"
template_overwrite => true
}
stdout { codec => json }
}
I think I am going crazy.
The above mapping isnt working anymore.
warkolm
(Mark Walkom)
May 3, 2016, 8:57pm
5
LS translates %{+YYYY.MM.dd}
into an actual date before it passes it to ES, that's why.