I am using logstash 1.5.1 and elasticsearch 1.7.3.0. I used logstash elasticsearch output to index the records residing in a bunch of csv files, and used my own mapping document where I set strings to be not_analyzed, also set logstash default template match"*" as string not_analyzed. In kibana I also verified that string fields are not_analyzed, however, when I use kibana bar chart to create bucket on string field, the string is broken down into tokens.
As you can see for example the "path" field, in kibana mapping details, it is not_analyzed as what I set
Also, the value of "path" field is as follows, it is the path of csv files
Then when I use bar chart to do bucket based on "path" field you can see the legend, the "path" field values are broken down into tokens. Instead of "/.../testcsvimport/record220k-100_3.csv", it is broken down to "testcsvimport" "record220k" "100" "csv"...
I don't want it to be analyzed, I want to keep the whole path field as one string, how can I do it?
I have attached logstash .conf file that i used to export to elasticsearch index, please help me.
input {
file {
path => "/home/myfolder/testcsvimport/record*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
columns => ["some_column_names"] # the "path" field is added by csv filter
}
grok {
match => { "record_IP" => "%{IP:clientip}" }
}
geoip {
source => "clientip"
}
mutate
{
remove_field => [ "message", "host" ]
}
}
output {
elasticsearch {
host => "dev-elkstack:9200"
protocol => "http"
index => "mt_joined_record_index"
template_name => "mt_joined_record_type"
manage_template => false
}
}
