In Kibana, all my strings are getting split on the blank space character, whenever I choose 'Terms' option. Reading some threads on forums I understood that we need to change the fields to 'not_analyzed' in logstash. I am using logstash v2.3 and am unable to change to not_analyzed. Pls help
I checked that API. However, it suggests how to change a single field. What if I want to change the mapping of all the string fields so that none of them splits up?
You cannot change a field once it is in ES, you really need to define things before you send to ES.
If you don't want to split things up then look at analysis, essentially using not_analyzed on a field.
Yes, thanks..
Actually I needed these for my logstash indexes. Just realised that if i changed the index names to logstash-*, then every field has a non-analyzed version also getting created. it has a .raw suffix. I guess with this change , I do not really need to make changes to ES..Thanks for your help
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.