How to set default analyzer for new Logstash indices?

Elastic Stack Logstash
1

Hi, I'm new to the Elastic stack in general. I would like to know how to set or modify the default analyzer for new indices. I'm currently modifying the analyzer to stop queries from lower-casing the tokens. I have successfully done that using this:

PUT /logstash-*/_settings
{
  "settings": {
    "analysis": {
      "analyzer": {
        "default": {
          "filter": [],
          "type": "custom",
          "tokenizer": "whitespace"
        }
      }
    }
  }
}

However, it doesn't seem to apply for the new, automatically created indices (e.g. logstash-2019.01.20). Does anyone know how to make the modified settings apply automatically to new indices? Thanks!

2

Elasticsearch can be configured with one or more Index Templates, which allow you to define fields and options before an index is created based on the name of the index matching a pattern.

The Elasticsearch Output Plugin can be configured to manage the template for you, using manage_template => true and also providing the path to a file containing a template with the template option. This will send the provided template to Elasticsearch each time that the Logstash plugin starts up, ensuring it is up-to-date before any data is sent or additional indexes are created.

1 Like
3

Alright, thanks! I'll have a go at it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.