Dynamic template

Elastic Stack Elasticsearch
1

my dynamic template , as follow:
"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"match": "*",
"unmatch": ["message","*id"],
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match_mapping_type": "string",
"match": "message",
"mapping": {
"type":"text"
}
}
},
{
"prefix_id_as_integer": {
"match_mapping_type": "string",
"match": ["*id"],
"mapping": {
"type":"integer"
}
}
}
],

however， I get the /logstash-audit-/audit/_mapping
"dynamic_templates": [
{
"strings_as_keyword": {
"match": "",
"unmatch": "[message, *id]",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text"
}
}
},
{
"prefix_id_as_integer": {
"match": "[id]",
"match_mapping_type": "string",
"mapping": {
"type": "integer"
}
}
},
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],
I'm so confused, i never configured message_field and string_field.

2

Please format your code using </> icon as explained in this guide. It will make your post more readable and will help us help you.

Alternatively use markdown style like this:

```
CODE
```
4

thanks for your reply, my dynamic template, as follow:

"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"match": "*",
"unmatch": ["message","*id"],
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match_mapping_type": "string",
"match": "message",
"mapping": {
"type":"text"
}
}
},
{
"prefix_id_as_integer": {
"match_mapping_type": "string",
"match": ["*id"],
"mapping": {
"type":"integer"
}
}
}
],

however， I get the /logstash-audit-/audit/_mapping

"dynamic_templates": [
{
"strings_as_keyword": {
"match": "",
"unmatch": "[message, *id]",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text"
}
}
},
{
"prefix_id_as_integer": {
"match": "[id]",
"match_mapping_type": "string",
"mapping": {
"type": "integer"
}
}
},
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],
5

What's the question or problem you are trying to resolve?

7

i configure the dynamic template, including three fields: strings_as_keyword, message_as_text and prefix_id_as_integer.
but when i check the indice's mapping， it's dynamic template have five fields：strings_as_keyword, message_as_text，prefix_id_as_integer， message_field and string_fields. i wonder why this happen

8

You have dynamic mappings enabled, so if there are other fields that Elasticsearch see, it will automatically accept and create them, which means also adding to the mapping.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.