Mapper attachment issues (Elasticsearch)

Elastic Stack Elasticsearch
1

I have created mapper attachmet mapping as follow.

PUT test-2016.06.11/person/_mapping
{
    "person" : {
        "properties" : {
            "file" : {
                "type" : "attachment",
                "fields" : {
                    "content" : {"store" : "yes"},
                    "title" : {"analyzer" : "chinese", "store" : "yes"},
                    "date" : {"store" : "yes"},
                    "author" : {"analyzer" : "chinese", "store" : "yes"},
                    "keywords" : {"analyzer" : "chinese","store" : "yes"},
                    "content_type" : {"store" : "yes"},
                    "content_length" : {"store" : "yes"},
                    "language" : {"analyzer" : "chinese", "store" : "yes"}
                }
            }
        }
    }
}

However, when I go through the data I put into the index, I could not see any .raw field. How should I change my mapping to make .raw field possible in kibana?

Thanks in advance.

2

There is no raw field because you did not find any.

I think multi field does not work with mapper attachment plugin but you could try to define one.

The best option is to extract data on your side then send to Elasticsearch whatever doc/mapping you want... Or wait for 5.0 which will provide ingest attachment plugin.

3

May you explain a bit more on this part?

4

If you code in Java, use Apache Tika for example.

5

Does that mean if I just inserting data in Sense directly, there will be no ways to create the raw field?

6

Not sure about what you mean.

If you want to create a raw field, add it to your doc:

PUT index/type/1
{
  "raw": "value"
}
7

Oh, what I meant to say is to create field.raw in Kibana for data in mapper attachment like what the logstash will do for input data with default elasticsearch output template. Thanks.

Capture.PNG1021×191 3.07 KB

Also, is there anyway I can create a url mapping inside the index for my attachment?

8

You could apply the same template logstash is applying.

But why do you want to have that on an attachment field? Does not make sense to me to index a full document without any analyzer.

And I doubt it will work as I think that multfield is not supported in attachment plugin (might be wrong though).

9

How should I change my mapping then? I don't know how should I change my mapping template to make them create that raw field like logstash applying. I would like that field as I want to make some dashboard on it

Capture.PNG1292×570 38.2 KB

I have an author named cythia chiu and another named nicholas chow. But as you can see from the figure, my author name has been splited up. So how can I make them not splited up?

10

Mark this field as not_analyzed.