I have my logstash index template to detect a field type called klocker_app_name. I currently have logstash set up to pull from 2 redis instances, and on checking the docker logs, I see the template with the field is being installed properly:
Attempting to install template {:manage_template=>{"template"=>"logstash-*", "order"=>1, "index_patterns"=>["logstash*"], "settings"=>{"number_of_shards"=>2, "number_of_replicas"=>1}, "mappings"=>{"doc"=>{"properties"=>{"time"=>{"type"=>"date", "format"=>"basic_time_no_millis"}, "before"=>{"type"=>"date", "format"=>"strict_date_time"}, "after"=>{"type"=>"date", "format"=>"strict_date_time"}, "logsource"=>{"type"=>"ip"}, "klocker_app_name"=>{"type"=>"text", "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}}}}
however when checking the current day's mapping on ES, I do not see klocker_app_name appearing on the list. What could be causing this? I see the other fields that i specified in the template such as before and logsource