Hi,
I'm using fleet agent to collect logs from Azure event hub.
I'm simply trying to change mapping so one field would be a text instead of a keyword.
To make a long story short, I found the Component Templates that is responsible for the mapping logs-azure.eventhub@package.
It has a dynamic template that every string is converted to a keyword.
So I tried adding a mapped field like so:
"azure": {
"type": "object",
"properties": {
"eventhub": {
"type": "object",
"properties": {
"properties": {
"type": "object",
"properties": {
"requestUri": {
"type": "text",
"fields": {
"requestUriKeyword": {
"type": "keyword",
}
}
}
}
}
}
}
}
}
ignore the parenthesis as I may copied it incorrectly
I have a new index created almost every day and yet azure.eventhub.properties.requestUri keeps remaining a keyword even if I recreate the data view.
What am I missing?
I just can't seem to find the issue why the mapping isn't working.
Any help would be much appreciated.