I'm configuring the filebeat filebeat.yml to load elasticsearch index templates.
I have a few fields that I'd like to index as both type
keyword and type
text so I can use them for sorting and aggregation as well as for case-insensitive full-text search. This is supported using multi-fields but I can't figure out if filebeat supports creating templates for multi-fields.
For example, I'd like the field copr.service to have both
setup.template.name: "filebeat-6.6.1-application" setup.template.fields: "fields.yml" setup.template.overwrite: true setup.template.settings: index.number_of_shards: 8 index.number_of_replicas: 2 index.number_of_routing_shards: 16 index.codec: best_compression _source.enabled: true setup.template.append_fields: - name: corp.environment type: keyword - name: corp.service type: text - name: corp.role type: keyword - name: corp.log.ingestedTimestamp type: date