"index": "not_analyzed" in elasticsearch

Elastic Stack Elasticsearch
1

i have delete mapping with the cmd

curl -XDELETE 'http://localhost:9200/logstash_log*/'

in my conf ,i have defined the index as follow,

output {
   elasticsearch {
   hosts => localhost
   index => "logstash_log-%{+YYYY.MM.dd}"
 }

and try to create a new mapping , but i got the error

 #curl -XPUT http://localhost:9200/logstash_log*/_mapping/log -d '

{


     "properties":{
          "@timestamp":"type":"date","format":"strict_date_optional_time||epoch_millis"},
           "message":{"type":"string"},
           "host":{"type":"ip"},
           "name":{"type":"string","index": "not_analyzed"},
           "type":{"type":"string"}
                }

}'

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"logstash_log*","index":"logstash_log*"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"logstash_log*","index":"logstash_log*"},"status":404}

How can i fix it?
any help will be appreciated!!

2

It looks like in the specified URL, the value above appeared to be an index name that does not exist. Check the document about mapping.

3

I have modify my logstash conf as below,

output {
   elasticsearch {
  hosts => localhost
  index => "logstash_log-%{+YYYY.MM.dd}"
  manage_template => true
  template_name => "log"
  template => "/path/to/index_template.json"
  template_overwrite => true
}

and add index_template.json

{
   "template" : "log",
   "mappings": {
  "log": {
  "properties": {
  "@timestamp": {
  "type": "date",
  "format": "strict_date_optional_time||epoch_millis"
    },
"message": {
  "type": "string"
 },
"host": {
  "type": "ip"
},
"name": {
  "type": "string",
  "index": "not_analyzed"
},
  "type": {
  "type": "string"
        }
      }
    }
  }
}

but from the kibana settings/ indices ,it's still using default template ,
any help would be appreciated.

4

Generally, the template mapping for a given index is loaded once, you don't need to load it every time. Since I'm not familiar with the template thing in logstash, I will not be able to comment about that.

Here is the link about loading template from ES standpoint

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html