Hello,
I am attempting apply the experimental index template feature, setup.template.append_fields, inside a filebeat config in order to set up a multifield datatype. This is an appealing feature because we don't want to have to support the entire field.yml file. I want a multifield datatype that will look like this in the index:
"stepid": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
I've attempted to mimic the structure in yaml but I get a different result. I have something like this:
setup.template.overwrite: true
setup.template.append_fields:
- name: fubar.stepid
type: text
fields:
keyword:
type: keyword
ignore_above: 256
Unfortunately I get a different result in the index:
"stepid": {
"type": "text",
"norms": false
}
I understand that copying the mapping in the index isn't a foolproof way to develop something but I don't have any other guidance to go on.
What am I missing here?