Here is the logstash template:
{
"logstash" : {
"order" : 0,
"version" : 60001,
"index_patterns" : [
"logstash_*"
],
"settings" : {
"index" : {
"number_of_shards" : "16",
"number_of_replicas" : "1",
"refresh_interval" : "5s"
}
},
"mappings" : {
"_meta" : { },
"_source" : { },
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"mapping" : {
"norms" : false,
"type" : "text"
},
"match_mapping_type" : "string"
}
},
{
"string_fields" : {
"mapping" : {
"norms" : false,
"type" : "text",
"fields" : {
"keyword" : {
"ignore_above" : 256,
"type" : "keyword"
}
}
},
"match_mapping_type" : "string",
"match" : "*"
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"geoip" : {
"dynamic" : true,
"type" : "object",
"properties" : {
"ip" : {
"type" : "ip"
},
"latitude" : {
"type" : "half_float"
},
"location" : {
"type" : "geo_point"
},
"longitude" : {
"type" : "half_float"
}
}
},
"@version" : {
"type" : "keyword"
}
}
},
"aliases" : { }
}
}
I used curl -XPUT "https://elastic:XXXX@es-logstash.mydomain.com:9200/logstash_dev-2021.02.04/_mappings" -H 'Content-Type: application/json' -d '{"_size": {"enabled": true}}}'
to enable the size mapping on todays index. I then went into Kibana/Index Patterns and clicked on the "Refresh field list" button and _size shows up in there. I also under Kibana/Index Management went to "Manage V/Refresh index"
When I do a query like
curl -XGET "https://elastic:XXXX@es-logstash.mydomain.com:9200/logstash_dev-2021.02.04/_search" -H 'Content-Type: application/json' -d@/tmp/sq.json` with sq.json = `{ "query": { "range": { "_size": {"gt": 10 } } }, "script_fields": { "size": { "script": "doc['_size']" } } }
I get results like
"total": {
"value": 10000,
"relation": "gte"
},
"max_score": 1,
"hits": [
{
"_index": "logstash_dev-2021.02.04",
"_type": "_doc",
"_id": "1VjzancBGd_I3ncXIyWN",
"_score": 1,
"fields": {
"size": [
308
]
}
},
When I go to single documents such as https://kibana.mydomain.com/s/dev/app/kibana#/discover/doc/04d4bdc0-eeaf-11ea-a9a7-cb52c38ca10e/logstash_dev-2021.02.04?id=1VjzancBGd_I3ncXIyWN the _size field doesn't show up, but you can query in Kibana such as "_size > 500"
How to add this mapping to an index template is still an open question.