default, elasticsearch use standard analyzer to every fields. But I only want to analyzer the fields "message", and other fields use non_analyzer, I don't know the all fields in the index, only "message" is fixed, other fields are parsed from "message".
so, how to config in the .yml file?
Check out dynamic templates [1] You can write rules for how new fields are to be treated. You can match on the JSON type of the new field or use an expression to match the name.
Use the API not .yml files to do this
[1] Customizing Dynamic Mapping | Elasticsearch: The Definitive Guide [2.x] | Elastic