How to configure index template with more then one analyzer?

Elastic Stack Elasticsearch
1

Hello,

I am trying to define index template where by default will be "whitespace" tokenizer but for a few fields I would like to specify "keyword" indexing.
I have tried following

POST /tracking-2016.11.*/_close
PUT /tracking-2016.11.*/_settings
{ "analysis": {
      "analyzer": {
        "default": {
           "type": "custom",
           "filter": [ "lowercase" ],
           "tokenizer": "whitespace",
           "fields": {
             "sourcesystem": {
               "type": "string",
               "tokenizer": "keyword"
             },
             "idmastermessage": {
               "type": "string",
               "tokenizer": "keyword"
             },
             "idsourcemessage": {
               "type": "string",
               "tokenizer": "keyword"
             }
           }
        }
      }
    }
}

POST /tracking-2016.11.*/_open
POST /tracking-2016.11.*/_refresh

but even if it didn't reported any error the sourcesystem is still returning values tokenized by space. Full value should be EMEA DCG UAT. Field pairing is tokenized properly:

  "aggregations": {
    "sourcesystem": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "dcg",
          "doc_count": 8,
          "pairing": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 1,
            "buckets": [
              {
                "key": "000000000551652269",
                "doc_count": 8
              },
              {
                "key": "00000551652270",
                "doc_count": 8
              },
              {
                "key": "ci1479806967810.5904183@czcholsint372_te",
                "doc_count": 8
              },

I didn't found any such way in documentation but tried combination of googling and attempt-fail methods.

Do you have somebody any experience with the combinations of analyzes?

Thanks in advance,
Cheers, Reddy

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.