# Mapping index

**URL:** <https://discuss.elastic.co/t/mapping-index/89742>\
**Category:** Elasticsearch\
**Created:** [June 16, 2017, 3:48pm UTC](https://discuss.elastic.co/t/mapping-index/89742 "2017-06-16T15:48:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![baha1](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@baha1](https://discuss.elastic.co/u/baha1)\
**Post date:** [June 16, 2017, 3:48pm UTC](https://discuss.elastic.co/t/mapping-index/89742/1 "2017-06-16T15:48:42Z")

</div>

Hi there,  
i have a mapping of an index like below:

```
"mappings": {
    "error": { 
      "_all": { "enabled": false }, 
      "properties": { 
        "message": { "type": "text" }, 
        "date": { "type": "text" }, 
        "level": { "type": "text" }  
      }
    }
  }

```

This is pipeline.conf:

```
    input {
            file {
            path => "c:/logstash.log"
            start_position => "beginning"
            sincedb_path => "/dev/null"
            codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => false
            what => "previous"
       }}}
    filter {
    grok{
    	  match => { "message" => "%{TIME:timestamp} %{LOGLEVEL:LEVEL} %{GREEDYDATA:errormsg}" }}}
    output {
    if	"ERROR" in [LEVEL]
    {
    elasticsearch {
      hosts=>"localhost:9200"
      index => "errors"
      }}

```

Please how can put the result of match in each properties:for example:  
date=timestamp;  
level=LEVEL;  
message=errormsg;

Thanks for help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2017, 11:32am UTC](https://discuss.elastic.co/t/mapping-index/89742/2 "2017-06-18T11:32:44Z")

</div>

That depends on what the event looks like.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2017, 11:32am UTC](https://discuss.elastic.co/t/mapping-index/89742/3 "2017-07-16T11:32:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.