I've got the following file in the config/templates directory. I know it's
being parsed, but it doesn't seem to have any effect on the field
definitions. I can tell from the mappings that something is happening, but
it's not what I want 
I'm not seeing any entries in the log file
indicating any issues.
{
"template_logstash" : {
"template": "logstash-",
"order": 1,
"mappings" : {
"raw" : {
"dynamic_templates" : [
{
template_3 : {
"match" : "_RAW",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"index" : "not_analyzed"
}
}
}
]
}
}
}
}
Test (should return ONE(1) row) actually returns about 7 so the
not_analyzed isn't working.
{
"query": {
"match_all": {}
},
"facets": {
"TermResults": {
"terms": {
"fields": [
"AppDetails:Version_RAW"
],
"size": 10
}
}
},
"size": 0
}
Metadata (partial)
{
state: open
settings: {
index.number_of_shards: 5
index.number_of_replicas: 1
index.version.created: 200699
}
mappings: {
raw: {
dynamic_templates: [
{
template_3: {
mapping: {
index: not_analyzed
type: string
}
match_mapping_type: string
match: *
}
}
]
properties: { }
}
hll: {
properties: {
@fields: {
dynamic: true
properties: {
ErrorLevel: {
type: string
}
EventDetails:DNIS: {
type: string
}
ElementType: {
type: string
}
AppDetails:Version_RAW: {
type: string
}
}
@timestamp: {
format: dateOptionalTime
type: date
}
@message: {
type: string
}
@source: {
type: string
}
@type: {
type: string
}
@source_host: {
type: string
}
@source_path: {
type: string
}
}
}
}
aliases: [ ]
}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
Anyone? I've been through everything I can think of and this should work.
It shows up in the schema, which I assume is the correct behavior.
Thanks,
Ralph
On Wednesday, August 28, 2013 11:54:16 AM UTC-6, Ralph Trickey wrote:
I've got the following file in the config/templates directory. I know it's
being parsed, but it doesn't seem to have any effect on the field
definitions. I can tell from the mappings that something is happening, but
it's not what I want 
I'm not seeing any entries in the log file
indicating any issues.
{
"template_logstash" : {
"template": "logstash-",
"order": 1,
"mappings" : {
"raw" : {
"dynamic_templates" : [
{
template_3 : {
"match" : "_RAW",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"index" : "not_analyzed"
}
}
}
]
}
}
}
}
Test (should return ONE(1) row) actually returns about 7 so the
not_analyzed isn't working.
{
"query": {
"match_all": {}
},
"facets": {
"TermResults": {
"terms": {
"fields": [
"AppDetails:Version_RAW"
],
"size": 10
}
}
},
"size": 0
}
Metadata (partial)
{
state: open
settings: {
index.number_of_shards: 5
index.number_of_replicas: 1
index.version.created: 200699
}
mappings: {
raw: {
dynamic_templates: [
{
template_3: {
mapping: {
index: not_analyzed
type: string
}
match_mapping_type: string
match: *
}
}
]
properties: { }
}
hll: {
properties: {
@fields: {
dynamic: true
properties: {
ErrorLevel: {
type: string
}
EventDetails:DNIS: {
type: string
}
ElementType: {
type: string
}
AppDetails:Version_RAW: {
type: string
}
}
@timestamp: {
format: dateOptionalTime
type: date
}
@message: {
type: string
}
@source: {
type: string
}
@type: {
type: string
}
@source_host: {
type: string
}
@source_path: {
type: string
}
}
}
}
aliases:
}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
I figured it out I had to change
"mappings" : {
"raw" : {
to
"mappings" : {
"default" : {
On Wednesday, August 28, 2013 11:54:16 AM UTC-6, Ralph Trickey wrote:
I've got the following file in the config/templates directory. I know it's
being parsed, but it doesn't seem to have any effect on the field
definitions. I can tell from the mappings that something is happening, but
it's not what I want I'm not seeing any entries in the log file
indicating any issues.
{
"template_logstash" : {
"template": "logstash-",
"order": 1,
"mappings" : {
"raw" : {
"dynamic_templates" : [
{
template_3 : {
"match" : "_RAW",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"index" : "not_analyzed"
}
}
}
]
}
}
}
}
Test (should return ONE(1) row) actually returns about 7 so the
not_analyzed isn't working.
{
"query": {
"match_all": {}
},
"facets": {
"TermResults": {
"terms": {
"fields": [
"AppDetails:Version_RAW"
],
"size": 10
}
}
},
"size": 0
}
Metadata (partial)
{
state: open
settings: {
index.number_of_shards: 5
index.number_of_replicas: 1
index.version.created: 200699
}
mappings: {
raw: {
dynamic_templates: [
{
template_3: {
mapping: {
index: not_analyzed
type: string
}
match_mapping_type: string
match: *
}
}
]
properties: { }
}
hll: {
properties: {
@fields: {
dynamic: true
properties: {
ErrorLevel: {
type: string
}
EventDetails:DNIS: {
type: string
}
ElementType: {
type: string
}
AppDetails:Version_RAW: {
type: string
}
}
@timestamp: {
format: dateOptionalTime
type: date
}
@message: {
type: string
}
@source: {
type: string
}
@type: {
type: string
}
@source_host: {
type: string
}
@source_path: {
type: string
}
}
}
}
aliases:
}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.