New to es...
We use logstash & es for our app logs, with Elastic Cloud providing es. We upgraded to es 5.1.2 recently.
When new indices are created, they have a dynamic_template including a "string_fields" clause that has a "raw" field of type "string".
I expected new indices to be created with something conforming to https://www.elastic.co/blog/strings-are-dead-long-live-strings, i.e.
What I expected:
"dynamic_templates": [
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
]
What I got:
"dynamic_templates": [
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fielddata": {
"format": "disabled"
},
"fields": {
"raw": {
"ignore_above": 256,
"index": "not_analyzed",
"type": "string"
}
},
"index": "analyzed",
"omit_norms": true,
"type": "string"
}
}
}
],
I got the new index with the above dynamic_template by creating a new index and re-indexing from one of our existing indices (which was created after we upgraded to 5.1.2):
PUT logstash-doug_test
and then...
POST _reindex
{
"size": 1000,
"source": {
"index": "logstash-2017.03"
},
"dest": {
"index": "logstash-doug_test"
}
}