Deprecated "include_in_all"

Hi all, how would I get the same functionality as this template by using the "copy_to" on the mapping fields?

{
"index_patterns": [
"tid*"
],
"settings": {
"index": {
"number_of_shards": "5"
}
},
"mappings": {
"test": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"type": "keyword"
}
}
}
}
}
],
"numeric_detection": true,
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"clock": {
"type": "long"
},
"test_Id": {
"type": "keyword"
},
"test_Name": {
"type": "keyword"
},
"test_type": {
"type": "keyword"
},
"test_result": {
"type": "keyword"
},
"test1_Id": {
"type": "keyword"
},
"test_Name": {
"type": "keyword"
},
"destination_ip": {
"type": "keyword"
},
"destination_ip_lookup": {
"type": "keyword"
},
"destination_tcp_udp_port": {
"type": "long"

      }
    }
  }
},
"aliases": {}

}

Hi @Jasonespo,

the Custom All FIelds section of the documentation gives an example of that. In order for all queries against an index to use the "custom all field" the index.query.default_field index setting can be changed accordingly.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.