How do I add doc_values to logstash index mapping template in Elasticsearch?

Elastic Stack Elasticsearch
1

This is the default logstash index mapping template I currently have in elasticsearch :

{
"order" : 0,
"template" : "logstash-",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"default" : {
"dynamic_templates" : [
{
"message_field" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string"
},
"match_mapping_type" : "string",
"match" : "message"
}
},
{
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match_mapping_type" : "string",
"match" : ""
}
}
],
"properties" : {
"geoip" : {
"dynamic" : true,
"path" : "full",
"properties" : {
"location" : {
"type" : "geo_point"
}
},
"type" : "object"
},
"@version" : {
"index" : "not_analyzed",
"type" : "string"
}
},
"_all" : {
"enabled" : true
}
}
},
"aliases" : {
}
}
Where am I suppose to add the doc_values field ? I'm interested only in adding it to the template, not re-indexing old indices.

The documentation says that you can't add doc_values to analyzed string fields.

Thanks.

2

You'll want to add it to the .raw section.

"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string",
"doc_values": true
}