# Dynamic index mapping with pattern filter

**URL:** <https://discuss.elastic.co/t/dynamic-index-mapping-with-pattern-filter/118663>\
**Category:** Elasticsearch\
**Created:** [February 6, 2018, 2:24pm UTC](https://discuss.elastic.co/t/dynamic-index-mapping-with-pattern-filter/118663 "2018-02-06T14:24:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shivanshu\_Bagga](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\
**Post date:** [February 6, 2018, 2:24pm UTC](https://discuss.elastic.co/t/dynamic-index-mapping-with-pattern-filter/118663/1 "2018-02-06T14:24:40Z")

</div>

Hi,

I'm using my own custom analyzer with dynamic json mapping.Following substring pattern substring first 500 chars of string and send for analyzing.

```
"index": {
    "analysis": {
        "char_filter": {
            "punctuation_pattern": {
                "type": "pattern_replace",
                "pattern": "\\p{Punct}", 
                "replacement": " " 
            },
            "substring_pattern":{
                "type": "pattern_replace",
                "pattern": "^(.{1,500}(?<=\\S)\\b).*$",
                "replacement": "$1"
            }
        },
        "analyzer": {
            "log_analyzer": {
                "tokenizer": "standard",
                 "char_filter": [
                    "punctuation_pattern",
                    "substring_pattern"
                ]
            }
        }
    }
}

```

And Mapping is

```
 "mappings" : {
    "doc" : {
      "properties" : {
          "Message": {
            "type": "text",
            "analyzer": "log_analyzer",
            "index_options": "positions"
          }
         }
    }
}

```

This is working fine if "Message" is not empty , but if Message is empty then I'm getting following error on Logstash console output.

`[2018-02-06T07:23:04,973][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.02.06", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x3fbdf907>], :response=>{"index"=>{"_index"=>"logstash-2018.02.06", "_type"=>"doc", "_id"=>"SmURa2EBGlSqJHLRzIOj", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [Message]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:29"}}}}}`

And I don't receive that message in elasticsearch.

Any luck , How can I update substring pattern so that It only execute if given input is not empty otherwise skip it or How can do substring with some other method?

Thanks ,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 2:25pm UTC](https://discuss.elastic.co/t/dynamic-index-mapping-with-pattern-filter/118663/2 "2018-03-06T14:25:09Z")

</div>

Closed on March 6, 2018, 2:25pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.