ES 2.4.1
I create a daily logstash index to meet my needs, which has the form "logstash-application-customer-YYYY.MM.dd" where the YYYY.MM.dd is of course the value that meets the "daily" requirement. I can have many applications and many customers, but those do not change daily.
So per the API I got my mapping and got this sample snippet
{
"logstash-applicationX-customer-2017.03.29" : {
"mappings" : {
"appX_type_log_1" : {
# Mappings for log_1 types
}
"appX_type_log_2" : {
# Mappings for log_2 types
}
}
}
}
I need different types because my Grok filters are conditioned on these types, though I do have the same fields for ALL the types for each application.
This means that I'll have a different mapping for an index created on a different day, which will look exactly the same as the above mapping, correct? Also I noticed that the type_log_1 mappings, are EXACTLY the same as the type_log_2 mappings. So how can I create a mapping that essentially does this for applicationX
{
"logstash-applicationX-*" : {
"mappings" : {
"appX_type_*" : {
# Mappings for ALL types for logstash-applicationX-*
}
}
}
}
I can then have a different mapping for applicationY, which has different types.
{
"logstash-applicationY-*" : {
"mappings" : {
"appY_type_*" : {
# Mappings for ALL types for logstash-applicationY-*
}
}
}
}
Does that make sense?