Logstash elasticsearch output. How to change mapping?


(Martin K) #1

Hi,
Problem 1: I've got problem with default mapping which is created by logstash. I've created my own mapping. But i cant change it. in blogarticles index is still only the default one created by JDBC.

I tried to create template with mappings, but it ignored too. But template exists in ES, so it's valid.

Here is my config:

input {

	jdbc {
	jdbc_driver_library => "..../mysql-connector-java-5.1.43-bin.jar"
	jdbc_driver_class => "com.mysql.jdbc.Driver"
	jdbc_connection_string => "...."
	jdbc_user => "...."
	jdbc_password => "...."
	statement_filepath => "myconfigs/blogArticles.sql"
	}
}

filter {
    json {
        source => "user_json"
        target => "user"
        remove_field => "user_json"
    }
}


output {
    stdout { codec => rubydebug }
    elasticsearch {
        index => "blogarticles"
        document_type => "blogarticle"
        document_id => "%{id}"
        template_name => "blogarticles"
        template => "myconfigs/mapping/blogArticles.json"
        template_overwrite => true
    }
}

Could someone help me please?

Also I've got Problem 2:
Can i split my settings+mapping.json into 2 files? I would like to use settings.json part for more indexes and i dont want to repeat same code more times.

So i would like to split this file into 2 pieces. Separately settings part and mappings part.

{

  "settings": {

    "number_of_shards": 5,

    "analysis": {
            ....
    }

  },

   "mappings": {

    "blogarticle": {

      "properties": {

          ....
  }

}

   }

 }

But if i run:
curl -H "Content-Type: application/json" -XPUT localhost:9200/blogarticles?pretty --data-binary "@myconfigs/mapping/settings.json"
call curl -H "Content-Type: application/json" -XPUT localhost:9200/blogarticles?pretty --data-binary "@myconfigs/mapping/mapping.json"

i'am getting following exception: index_already_exists_exception

Any leads please?

Thank you guys :slight_smile:


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.