We have created our own custom analyzer definition based on our application-wide needs. This new analyzer is needed in different indexes. Each index has its own template (mapping, settings, etc.).
To provide the analyser (and some other mappings) to all indexes, we have already defined a global template. Now we want to add the analyzer to the global template, but it does not work!
What am I doing wrong?
Our global template:
{
"syslog": {
"order": 0,
"version": 1,
"index_patterns": [
"syslog-*"
],
"settings": {
"index": {
"analysis": {
"filter": {
"email": {
"type": "pattern_capture",
"preserve_original": "true",
"patterns": [
"([^@]+)",
"(\p{L}+)",
"(\d+)",
"@(.+)"
]
}
},
"analyzer": {
"email": {
"filter": [
"email",
"lowercase",
"unique"
],
"tokenizer": "uax_url_email"
}
}
}
}
},
"mappings": {
"doc": {
"numeric_detection": true
......................
}
}
}
}
And now our index specific template. In this template we used the analyser "email":
PUT _template/syslog-mail
{
"order": 1,
"version": 0,
"index_patterns": [
"syslog-mail-*"
],
"settings": {},
"mappings": {
"doc": {
"properties": {
"postfix_to": {
"type": "text",
"norms": false,
"analyzer": "email",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
If I want to PUT the mail template, the following error occurs:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "analyzer [domain_name_analyzer] not found for field [analyzed]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [doc]: analyzer [domain_name_analyzer] not found for field [analyzed]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "analyzer [domain_name_analyzer] not found for field [analyzed]"
}
},
"status": 400
}
Our global mappings already woks fine. Why can I not use the globally defined analyzer?
Or how do I define an analyzer for multiple indexes?