GROK query generating .keyword fields in Elasticsearch

Elastic Stack Logstash
1

Hi there,
I'm happily parsing a bunch of syslog files in Logstash, but notice that an entry like %{DATA:Something} creates a Something field and additionally a Something.keyword field in Elasticsearch.

Is there a way to suppress the generation of this additional Something.keyword field and it's duplicate data?

Thank you!

2

This is really an elasticsearch question. The default template creates a keyword for every text field. This blog post provides background on why. You will need to supply a different template.

1 Like
3

Thank you - that's really helpful.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.