Is it possible to have multi-field like this?


(Anh) #1

I'm upgrading one of the fields in IIS Logs to multi field, and I don't see it appear in Kibana.

Old field mapping:

 "cs-uri-stem": {
    "index": "not_analyzed",
    "type": "string",
    }

New field mappings

  "cs-uri-stem": {
    "index": "not_analyzed",
    "type": "string",
    "fields": {
      "full": {
        "index": "analyzed",
        "type": "string"
      }
    }
  }

Is it possible to have not_analyzed first, and the full fields is analyzed? I use to see analyzed and then .raw with not_analyzed. Following this approach will create conflicts with my old indexes.

Thanks,


(Anh) #2

any comment?


(system) #3