I have an index (whitelist) so defined
{ "mapping": { "_doc": { "properties": { "@timestamp": { "type": "date" }, "network": { "type": "ip_range" } } } } }
I need to update network field to support multi_fileds, i.e. I need that this index changes in:
{ "mapping": { "_doc": { "properties": { "@timestamp": { "type": "date" }, "network": { "type": "ip_range" "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } } } }
How can I use _mapping api to do this?
I tried unsuccessfully with command like this one (and different variants), but all return errors.
curl -X PUT "<machine>:9200/whitelist/_mapping" -H 'Content-Type: application/json' -d ' { "properties": { "network":{"type":"ip_range","ignore_above":256} } } } '