Any idea if we can set some default value to particular field, while defining the mapping for an index. For example I have a log which writes to 10 lines (not necessarily in same order) and identified with request I'd. Where as say doc1 with request id 1 , gets written at line 1, 2, 3,4,8,9 and then doc 2 with request id gets written at line no 5,6,7,10 lines in the log file. (I am making request id as document_id so as to append/update the same request to one record)
So, as soon as I get message as started in my request I Mark the status as "running" in y logstash parsing and when I get a log having "completed" it makes/updates the status field as "finished". Hence the catch is Running is set when I see start and finished is set when I see completed.
But as request are asynchronous, So sometime es gets "completed" message before "start" while indexing the same as a result even though request is completed it gets tagged as running. So, can I make something like status = running as default while creating an index/mapping/template
In that case if value is not specified while indexing the record, it will not be updated/inserted but will have default value as "running" and when ever I see completed I make it as "finished"