Elastic Cloud (5.1.2) creating dynamic_template with 'raw' instead of 'keyword'

Elastic Stack Elasticsearch
1

New to es...
We use logstash & es for our app logs, with Elastic Cloud providing es. We upgraded to es 5.1.2 recently.
When new indices are created, they have a dynamic_template including a "string_fields" clause that has a "raw" field of type "string".
I expected new indices to be created with something conforming to https://www.elastic.co/blog/strings-are-dead-long-live-strings, i.e.

What I expected:

   "dynamic_templates": [
      {
        "string_fields": {
          "match": "*",
          "match_mapping_type": "string",
          "mapping": {
            "fields": {
              "keyword": {
                "type": "keyword"
              }
            },
            "norms": false,
            "type": "text"
          }
        }
      }
    ]

What I got:

    "dynamic_templates": [
      {
        "string_fields": {
          "match": "*",
          "match_mapping_type": "string",
          "mapping": {
            "fielddata": {
              "format": "disabled"
            },
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }
            },
            "index": "analyzed",
            "omit_norms": true,
            "type": "string"
          }
        }
      }
    ],

I got the new index with the above dynamic_template by creating a new index and re-indexing from one of our existing indices (which was created after we upgraded to 5.1.2):

PUT logstash-doug_test

and then...

POST _reindex
{
  "size": 1000,
  "source": {
    "index": "logstash-2017.03"
  },
  "dest": {
    "index": "logstash-doug_test"
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.