Defining dynamic types in field.yml

Elastic Stack Beats
1

I'm struggling a bit to define dynamic types in field.yml for my Statsdbeat

There are some fields that are predefined. But some some fields are dynamic.

My fields.yml is defined as

- key: statsdbeat
  title: statsdbeat
  description: test
  fields:
    - name: statsd
      type: group
      fields:        
        - name: bucket
          type: text
          ignore_above: 1024        
          description: >
            statsd bucket
        
        - name: val
          type: long          
          description: >
            value for the bucket
        
        - name: type
          type: keyword
          ignore_above: 255        
          description: >
            The type of statsd counter  gauge  histogram.
        
        - name: context
          type: object
          object_type: keyword
          dynamic: true
          description: >
            Contains user tags

When I look in Elastic search on the submitted index template I see

> GET _template/statsdbeat*

{
  "statsdbeat-6.3.3": {
    "order": 1,
    "index_patterns": [
      "statsdbeat-6.3.3-*"
    ],
    "mappings": {
      "doc": {
        "_meta": {
          "version": "6.3.3"
        },
        "date_detection": false,
        "dynamic_templates": [
          ...<deleted>...
          {
            "statsd.context": {
              "path_match": "statsd.context.*",
              "mapping": {
                "type": "keyword"
              },
              "match_mapping_type": "string"
            }
          },
          {
            "strings_as_keyword": {
              "mapping": {
                "type": "keyword",
                "ignore_above": 1024
              },
              "match_mapping_type": "string"
            }
          }
        ],

This seems to be correct (?).
But when I submit a value for

"statsd.context.userField": "customValue"

The "statsd.context.userField" shows "No cached mapping"

I was expecting that new fields of type string would be mapped to keywords.

2

Hi @sentient,

Configuration and mapping look good, yes. Where are you seeing the "No cached mapping" message? If it is in kibana you may need to refresh the field list from the Index patterns management view.

3

It was indeed just the UI of Kibana that threw me off.

all good

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.