How to write mapping for extra fields of Logstash


sorry, I did ask this before (in Logstash's group) but I lost it from my
emails and can't seem to find out from public archives. It's more
ES-centered though.

When we add custom fields to parse our logs, logstash appends the string
'@fields' to those new fields and will have an output as below:

from unknown[]","@type":"postfix"}

In order to map the, etc, I've created a mapping
as in the below link:

Could you please verify if it's correct?


You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
For more options, visit