How to Turn OFF analyzed for one field in the logstash-* index

It looks like you are getting an error when you are trying to set a mapping template. Can you provide the full command you are passing to Elasticsearch, and the full error message?

Also note that in Logstash 1.3.1 and above, there is a logstash indexing template provided which adds a .raw field to every field you index, which is mapped as not_analyzed and is the original value as-is. So you might not need to adjust the mappings at all - just use the original field when you want an analyzed string, and the .raw of that field when you want the not_analyzed original value.

1 Like