Dynamic template with logstash question

Elastic Stack Logstash
1

Hi guyes, im having some issues with my template and I wanted to clear up if im using the path_unmatch correctly.

Im using the default logstash index template with one change.
The keyword match "*" now has a path_unmatch as so

    "string_fields" : {
      "match" : "*",
      "path_unmatch" : "webapp.*",
      "match_mapping_type" : "string",
      "mapping" : {
        "type" : "text", "norms" : false,
        "fields" : {
          "keyword" : { "type": "keyword", "ignore_above": 256 }
        }
      }

I have KV filter which parses URI params into the target folder "webapp" however I dont want to have these field indexed as both analysed and keyword as it quickly adds up to field exhaustion , However when this used i still get

webapp.field and
webapp.field.keyword

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.