Error while updating topbeat template

Elastic Stack Elasticsearch
1

Hi.. Im trying to modify the topbeat template.. hav an additional field and need to make that analyzed. I modified the template to exclude my field name from not_analysed by using unmatch

"match": "*"
"unmatch": "my_field_name"
But Getting error unexpected character ('"' (code 34)): was expecting comma to separate object entries

Any help

2

Is this the right way??? Kindly confirm

              "template1": {
                "mapping": {
                  "doc_values": true,
                      "ignore_above": 1024,
                          "index": "not_analyzed",
                             "type": "{dynamic_type}"
                          },
                   "match": "*" ,
                   "unmatch": "field_name"
            }
          }
       ],
3

This looks right. The above error message suggests that you forgot to put a comma somewhere in the json.

4

Couldn't figure out it

This is my topbeat template json. Could someone point where I missed

{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": "*",
"unmatch": "field_name"
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"cpu": {
"properties": {
"system_p": {
"doc_values": "true",
"type": "float"
},
"user_p": {
"doc_values": "true",
"type": "float"
}
}
},
"fs": {
"properties": {
"used_p": {
"doc_values": "true",
"type": "float"
}
}
},
"load": {
"properties": {
"load1": {
"doc_values": "true",
"type": "float"
},
"load15": {
"doc_values": "true",
"type": "float"
},
"load5": {
"doc_values": "true",
"type": "float"
}
}
},
"mem": {
"properties": {
"actual_used_p": {
"doc_values": "true",
"type": "float"
},
"used_p": {
"doc_values": "true",
"type": "float"
}
}
},
"proc": {
"properties": {
"cpu": {
"properties": {
"user_p": {
"doc_values": "true",
"type": "float"
}
}
},
"mem": {
"properties": {
"rss_p": {
"doc_values": "true",
"type": "float"
}
}
}
}
},
"swap": {
"properties": {
"used_p": {
"doc_values": "true",
"type": "float"
}
}
}
"taxonomy": {
"properties": {
"field1": {
"doc_values": "true",
"type": "float"
}

  }
}

},
"settings": {
"index.refresh_interval": "5s"
},
"template": "topbeat-*"
}

5

There is a missing comma right before "taxonomy".