Elasticsearch mapping not reflecting logstash fields

I have my logstash index template to detect a field type called klocker_app_name. I currently have logstash set up to pull from 2 redis instances, and on checking the docker logs, I see the template with the field is being installed properly:

Attempting to install template {:manage_template=>{"template"=>"logstash-*", "order"=>1, "index_patterns"=>["logstash*"], "settings"=>{"number_of_shards"=>2, "number_of_replicas"=>1}, "mappings"=>{"doc"=>{"properties"=>{"time"=>{"type"=>"date", "format"=>"basic_time_no_millis"}, "before"=>{"type"=>"date", "format"=>"strict_date_time"}, "after"=>{"type"=>"date", "format"=>"strict_date_time"}, "logsource"=>{"type"=>"ip"}, "klocker_app_name"=>{"type"=>"text", "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}}}}

however when checking the current day's mapping on ES, I do not see klocker_app_name appearing on the list. What could be causing this? I see the other fields that i specified in the template such as before and logsource

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.