Logstash 6.4.2 template mapping does not working

Elastic Stack Logstash
1

i have custom template mapping, but when the new index is created dynamically by logstash, index mapping is wrong, it differs from my template mappings and why?

Logstash Config

output {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "nginx_access_%{+YYYY-MM-dd}"
      template => "template_mapping.json"
      template_name => "es_fields_mapping"
      template_overwrite => true
      manage_template => true
    }
}

why fields(bytes, geoip.ip and etc) type is text? what is wrong?
example:

bytes field mapping

"bytes" : {
    "type" : "text",
       "fields" : {
         "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
        }
     }
  }

geoip.ip

"geoip" : {
  "properties" : {
    "ip" : {
      "type" : "text",
      "fields" : {
        "keyword" : {
          "type" : "keyword",
          "ignore_above" : 256
        }
      }
    }
  }
}

why? what is the solution? how can i configure logstash and elasticsearch?

2

You have to delete your index if you've defined a template after you first ingested data. You cannot change the template of an index. I suspect that is what has happened.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.