It cannot be done directly in the Logstash configuration. You will have to put it in an index template. The default index template Logstash provides only matches indices with a logstash-*
name pattern.
The current 5.x template can be found here.
As the setting is index.mapping.total_fields.limit: 2000
, it should fit before or after line 5 in that example, leaving it looking something like:
"settings" : {
"index.refresh_interval" : "5s",
"index.mapping.total_fields.limit": 2000
},
You can take this file and edit it as needed, particularly line 2, which currently reads "template" : "logstash-*"
, should match your index name pattern.
As far as putting that new template in, you can do so with these Logstash template directives in the elasticsearch output plugin block:
manage_template => true
template => '/path/to/template.json'
template_name => 'a_valid_name_here' # The default is logstash
template_overwrite => true