Force field to be analysed in indices

Elastic Stack Elasticsearch
1

In an index. How can we force a field to be analysed ?
I have some fiels that are note analysed. S

Thanks.

2

Unless you set them as not analysed, they will be analysed by default.

Maybe if you provide your mapping we can make some better recommendations.

3

I don't set not analysed, perhaps you can see that I have some fields that are not analysed:

1337×594 24.4 KB

My logstash config is:

input {
file {
path => "E:/STOZ/TDB/Datasource/Output/baie_z_Array_histo*.csv"
type => "core2"
start_position => beginning
}
}

filter {
csv {
columns => [
"DATE",
"BAIE",
"WP_USED_POURCENT",
"WP_LIMIT",
"WP_USED",
"MBS_READ",
"MBS_WRITE",
"IOS_WRITE",
"IOS_READ",
"RESPT_WRITE",
"RESPT_READ",
"MBS",
"IOS",
"PERIODE",
"SEMAINE",
"JOUR",
"PERIODEJ"
]
separator => ";"
}
date {
match => [ "DATE" , "yyyy-MM-dd HH:mm:ss" ]
}
mutate {
convert => ["WP_USED_POURCENT", "float"]
convert => ["WP_LIMIT", "float"]
convert => ["WP_USED", "float"]
convert => ["MBS_READ", "float"]
convert => ["MBS_WRITE", "float"]
convert => ["IOS_WRITE", "float"]
convert => ["IOS_READ", "float"]
convert => ["RESPT_WRITE", "float"]
convert => ["RESPT_READ", "float"]
convert => ["MBS", "float"]
convert => ["IOS", "float"]
}

}

output {
stdout {}
elasticsearch {
document_id => "%{@timestamp}_%{BAIE}"
hosts => ["10.155.91.101:9200"]
action => "index"
index => "index_stoz_baie_array_histo"
}
}

4

Not your LS config, your ES mapping - https://www.elastic.co/guide/en/elasticsearch/guide/master/mapping-intro.html#_viewing_the_mapping

5

Hi Mark,

This is my config :

 {
  "index_stoz_baie_array_histo": {
    "mappings": {
      "WP_USED": {
        "properties": {
          "tag": {
            "type": "string"
          }
        }
      },
      "core2": {
        "properties": {
          "@timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "@version": {
            "type": "string"
          },
          "BAIE": {
            "type": "string"
          },
          "DATE": {
            "type": "string"
          },
          "IOS": {
            "type": "double"
          },
          "IOS_READ": {
            "type": "double"
          },
          "IOS_WRITE": {
            "type": "double"
          },
          "JOUR": {
            "type": "string"
          },
          "MBS": {
            "type": "double"
          },
          "MBS_READ": {
            "type": "double"
          },
          "MBS_WRITE": {
            "type": "double"
          },
          "PERIODE": {
            "type": "string"
          },
          "PERIODEJ": {
            "type": "string"
          },
          "RESPT_READ": {
            "type": "double"
          },
          "RESPT_WRITE": {
            "type": "double"
          },
          "SEMAINE": {
            "type": "string"
          },
          "WP_LIMIT": {
            "type": "double"
          },
          "WP_USED": {
            "type": "double"
          },
          "WP_USED_POURCENT": {
            "type": "double"
          },
          "host": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "tags": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        }
      }
    }
  }
}
6

There doesn't appear to be any fields that aren't analysed there.

7

I only have this problem on indices with many fields.
There is no limit linked to the number of fields to be analysed?

8

No there is not.