Hi,
I 've change default filebeat-template to make "message" property type as "object".
But not shown as "object" in index. Shown as default "string".
Log says;
"2016/11/21 15:43:30.532659 output.go:164: INFO Loading template enabled. Trying to load template: /etc/filebeat/filebeat.template.json
2016/11/21 15:43:30.595836 output.go:172: INFO Existing template will be overwritten, as overwrite is enabled.
2016/11/21 15:43:30.919118 client.go:266: INFO Elasticsearch template with name 'filebeat' loaded"
Any idea?
# cat /etc/filebeat/filebeat.template.json
{
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": {
"enabled": false
}
},
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": ""
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"type": "object"
},
"offset": {
"type": "long",
"doc_values": "true"
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-"
}
# cat /etc/filebeat/filebeat.yml | grep template: -A 10
template:
Template name. By default the template name is filebeat.
name: "filebeat"
Path to template file
path: "/etc/filebeat/filebeat.template.json"
Overwrite existing template
overwrite: true