How to change the fields to 'not-analyzed'?

Elastic Stack Logstash
#1

I am a newbie, pls help me with doing this.

In Kibana, all my strings are getting split on the blank space character, whenever I choose 'Terms' option. Reading some threads on forums I understood that we need to change the fields to 'not_analyzed' in logstash. I am using logstash v2.3 and am unable to change to not_analyzed. Pls help

#2

You need to do that in ES via the mappings.

Look at the _mappings API call.

#3

I checked that API. However, it suggests how to change a single field. What if I want to change the mapping of all the string fields so that none of them splits up?

#4

That's a more detailed thing.

You cannot change a field once it is in ES, you really need to define things before you send to ES.
If you don't want to split things up then look at analysis, essentially using not_analyzed on a field.

#5

Can you pls suggest how to do that? I am quite new to the ELK stack and not getting really how to do what you are suggesting

#6

Maybe set a template in ES is helpful for you. https://www.elastic.co/guide/en/elasticsearch/reference/current/default-mapping.html

eg:
curl -XPUT 'localhost:9200/_template/all' -d '
{
        "order": 0,
        "template": "*",
        "settings": {
            "index.number_of_shards": "1"
        },
        "mappings": {
            "_default_": {
                "dynamic_templates": [
                    {
                        "string": {
                            "mapping": {
                                "index": "not_analyzed",
                                "type": "string"
                            },
                            "match_mapping_type": "string"
                        }
                    }
                ]
            }
        },
        "aliases": {}
    }
}
'

It will set all the string type field not_analyzed.

#7

Yes, thanks..
Actually I needed these for my logstash indexes. Just realised that if i changed the index names to logstash-*, then every field has a non-analyzed version also getting created. it has a .raw suffix. I guess with this change , I do not really need to make changes to ES..Thanks for your help

#8