Dynamically add keyword field to text field

Elastic Stack Elasticsearch
1

Hello everyone,

I have various fields i want to index as text and keyword from Logstash.
I'm using an index template with static mappings to define data types and analyzers for my fields that look like these:

"field.name": {
    "fields": {
     "keyword": {
      "norms": false,
      "type": "keyword"
     }
    },
    "ignore_above": 1024,
    "type": "text",
    "analyzer": "simple"
   }
}

My dynamic template:

"dynamic_templates": [
  {
    "string_fields": {
      "mapping": {
        "norms": False,
        "type": "text",
          "fields": {
            "keyword": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
      },
      "match_mapping_type": "string",
      "match": "*"
    }
  }
]

If I index Documents, only the text field is used, the keyword fields are always empty.
My question is, is there a way to configure Logstash, Elasticsearch or the template to index the field as text and keyword without copying all fields manually to their keyword counterpart in Logstash?

Thanks for answering,
Ole

2

I'm stupid, it was another issue, this works just fine.
For some reason i still don't understand Logstash was not overwriting the template despite template_overwrite => true was set.

When I increment the version of the template, Logstash seems to overwrite it, so maybe it's just that.

Guess I should have checked the stored template earlier.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.