Logstash input twitter

(adnan baykal) #1

I am using logstash-input-twitter plugin. I dont want certain fields to be not_analyzed. is this something I can define in the output tag? if so, can you provide an example?


(Aaron Mildenstein) #2

not_analyzed is handled at the Elasticsearch level.

By default, the Elasticsearch mapping template included with Logstash (which applies to indices named logstash-YYYY.MM.dd) has a "multi-field" mapping. All string fields automatically get both an analyzed (the regular field name) and not_analyzed (fieldname.raw) version of the field.

If you have a different index naming pattern, this template will not be applied.

(adnan baykal) #3

I thought they removed the .raw field from 1.5

(Aaron Mildenstein) #4

Only from the message field. All other string fields get the .raw treatment still.

(adnan baykal) #5

how do I access the .raw field from the kibana to create graphs?

(Aaron Mildenstein) #6

All string fields should have a .raw version, e.g. fieldname would also appear as fieldname.raw

(system) #7