I have an index with a sub-filed that I want to set to be not analyzed? How can I change this?
Additionally, this indexes are patterned for the day using Filebeat -- is there a way to ensure when new indices are created by Filebeat, the same not analyzed configuration takes place?
Here is my index myrecords-YYYY-MM-DD:
{
"myrecords-2016.10.25": {
"aliases": {},
"mappings": {
"log": {
"properties": {
"@timestamp": {
"type": "date",
"format": "dateOptionalTime"
},
"user_info": {
"properties": {
"channel": {
"type": "string"
},
"channel_params": {
"properties": {
"b_length": {
"type": "long"
},
"current_view": {
"type": "string"
},
"m_status": {
"type": "boolean"
},
"is_official": {
"type": "boolean"
}
}
},
"viewer": {
"properties": {
"platform": {
"type": "string"
},
"player": {
"type": "string"
}
}
}
}
},
"response": {
"type": "string"
}
}
}
},
"settings": {
"index": {
"creation_date": "1477353651509",
"number_of_shards": "5",
"number_of_replicas": "1",
"version": {
"created": "1050299"
},
"uuid": "OmI6yE8CQJS-wqVIfHsbig"
}
},
"warmers": {}
}
}
I want to change current_view
to be not_analyzed and I want the change to take place for every new index created by filebeat when shipping logs to ES.