Dynamic template


(Piingluo) #1

my dynamic template , as follow:
"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"match": "*",
"unmatch": ["message","*id"],
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match_mapping_type": "string",
"match": "message",
"mapping": {
"type":"text"
}
}
},
{
"prefix_id_as_integer": {
"match_mapping_type": "string",
"match": ["*id"],
"mapping": {
"type":"integer"
}
}
}
],

however, I get the /logstash-audit-/audit/_mapping
"dynamic_templates": [
{
"strings_as_keyword": {
"match": "
",
"unmatch": "[message, *id]",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text"
}
}
},
{
"prefix_id_as_integer": {
"match": "[id]",
"match_mapping_type": "string",
"mapping": {
"type": "integer"
}
}
},
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "
",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],
I'm so confused, i never configured message_field and string_field.


(Mark Walkom) #2

Please format your code using </> icon as explained in this guide. It will make your post more readable and will help us help you.

Alternatively use markdown style like this:

```
CODE
```

(Piingluo) #4

thanks for your reply, my dynamic template, as follow:

"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"match": "*",
"unmatch": ["message","*id"],
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match_mapping_type": "string",
"match": "message",
"mapping": {
"type":"text"
}
}
},
{
"prefix_id_as_integer": {
"match_mapping_type": "string",
"match": ["*id"],
"mapping": {
"type":"integer"
}
}
}
],

however, I get the /logstash-audit-/audit/_mapping

"dynamic_templates": [
{
"strings_as_keyword": {
"match": "",
"unmatch": "[message, *id]",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text"
}
}
},
{
"prefix_id_as_integer": {
"match": "[id]",
"match_mapping_type": "string",
"mapping": {
"type": "integer"
}
}
},
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],

(Mark Walkom) #5

What's the question or problem you are trying to resolve?


(Piingluo) #7

i configure the dynamic template, including three fields: strings_as_keyword, message_as_text and prefix_id_as_integer.
but when i check the indice's mapping, it's dynamic template have five fields:strings_as_keyword, message_as_text,prefix_id_as_integer, message_field and string_fields. i wonder why this happen


(Mark Walkom) #8

You have dynamic mappings enabled, so if there are other fields that Elasticsearch see, it will automatically accept and create them, which means also adding to the mapping.


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.