How to create a index template for all type

Elastic Stack Elasticsearch
1

Hi all
I created a index template as following:

{
    "template" : "logstash-bmwrtti-*",
    "settings" : {
        "index.refresh_interval" : "5s",
        "analysis" : {
            "tokenizer" : {
                "url_tokenizer" : {
                    "type" : "pattern",
                    "pattern" : "&"
                }
            },
            "analyzer" : {
                "url_analyzer" : {
                    "type" : "custom",
                    "tokenizer" : "url_tokenizer",
                    "filter" : ["lowercase"]
                }
            }
        }
    },
    "mappings" : {
        "_default_" : {
        	"_all": { 
                "enabled": true
            },
            "properties" : {
                "rowkey" : {
                    "type" : "text"
                },
                "dirveid" : {
                    "type" : "text",
                    "fielddata": true
                },
                "uri" : {
                    "type" : "text",
                    "analyzer" : "url_analyzer"
                },
                "reqtime" : {
                    "type" : "date",
                    "format" : "epoch_millis"
                },
                "restime" : {
                    "type" : "date",
                    "format" : "epoch_millis"
                },
                "answertime" : {
                    "type" : "integer"
                },
                "serverip" : {
                    "type" : "ip"
                },
                "adcode" : {
                    "type" : "text"
                },
                "ccplonlat" : {
                    "type" : "geo_point"
                },
                "deslonlat" : {
                    "type" : "geo_point"
                },
                "cversion" : {
                    "type" : "text"
                },
                "dversion" : {
                    "type" : "text"
                },
                "responsesize" : {
                    "type" : "integer"
                },
                "datatype" : {
                    "type" : "text"
                }
            }
        }
    }
}

two questions:
1、When I run a logstash to output document to the elasticsearch, each type will be created a mapping.:sweat:
How to create a index template for all type?
2、When I call the cardinality agg for field [driveid] , returning the [driveid] need set fielddata=true
How to set the not analyzer?

PS: my es version is 5.1 .

2

"_default_" means that unless there is a type defined mapping, use this one. You can also use * in there.

For 5.X, you need to define a field as the "type": "keyword" for it to be not analysed.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.