Hello everyone, i'm new to ES and after reading multiple topics i'm still facing an issue with adding missing mapping to existing index. The main thing is that i'm missing geoip fields in Elasticsearch. I've found some existing templates with them but unfortunatelly they're using some depraceted fields. So, i've edited these file to be compatible with ES 6.3.1, but i'm not sure if that' ok so you can take a look on it here.
My index name is logstash-*, i've already some indices from last days, lets say they're named as logstash-2018.08.17 etc. I'm out of idea how to add mappings to an exsisting indices to get it working ? I would be gracefull if someone can direct me how to do it.
{
"index_patterns" : "logstash-",
"version" : 60001,
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_doc" : {
"dynamic_templates" : [ {
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
}, {
"string_fields" : {
"match" : "",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text", "norms" : false,
"fields" : {
"keyword" : { "type": "keyword", "ignore_above": 256 }
}
}
}
} ],
"properties" : {
"@timestamp": { "type": "date"},
"@version": { "type": "keyword"},
"geoip" : {
"dynamic": true,
"properties" : {
"ip": { "type": "ip" },
"location" : { "type" : "geo_point" },
"latitude" : { "type" : "half_float" },
"longitude" : { "type" : "half_float" }
}
}
}
}
}
}