Not able to update mapping in template

Elastic Stack Elasticsearch
1

Hi ,
i recently installed 6.4 version . Uploaded few logs and new index got created .Now i want to use template .

When i am using below query to create template , only "default" mapping is updated but not the "doc"

My template Query
PUT logstash-template-
{
"order" : 0,
"index_patterns" : [
"logstash-template-"
],
"settings" : {
"index" : {
"number_of_shards" : "1",
"codec" : "best_compression"
}
},
"mapping": {
"doc": {
"_source": {
"enabled": false
},
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"var": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"ip": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"sessionId": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"type": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"userId": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"filename": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"writeBytes": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "long"
}
}
},
"readBytes": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "long"
}
}
},
"event": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"var2": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"beat": {
"properties": {
"hostname": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"geoip": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
},
"host": {
"properties": {
"name": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"input": {
"properties": {
"type": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"message": {
"type": "text",
"norms": false
},
"offset": {
"type": "long"
},
"prospector": {
"properties": {
"type": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"source": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"tags": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
},
"default": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"geoip": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
}
}
}
},
"aliases" : { }
}

Regards Nitin

2

Template in system created after my query
GET logstash-template-
{
"logstash-template-":{
"aliases":{

  },
  "mappings":{  
     "default":{  
        "dynamic_templates":[  
           {  
              "message_field":{  
                 "path_match":"message",
                 "match_mapping_type":"string",
                 "mapping":{  
                    "norms":false,
                    "type":"text"
                 }
              }
           },
           {  
              "string_fields":{  
                 "match":"*",
                 "match_mapping_type":"string",
                 "mapping":{  
                    "fields":{  
                       "keyword":{  
                          "ignore_above":256,
                          "type":"keyword"
                       }
                    },
                    "norms":false,
                    "type":"text"
                 }
              }
           }
        ],
        "properties":{  
           "@timestamp":{  
              "type":"date"
           },
           "@version":{  
              "type":"keyword"
           },
           "geoip":{  
              "dynamic":"true",
              "properties":{  
                 "ip":{  
                    "type":"ip"
                 },
                 "latitude":{  
                    "type":"half_float"
                 },
                 "location":{  
                    "type":"geo_point"
                 },
                 "longitude":{  
                    "type":"half_float"
                 }
              }
           }
        }
     }
  },
  "settings":{  
     "index":{  
        "codec":"best_compression",
        "refresh_interval":"5s",
        "number_of_shards":"1",
        "provided_name":"logstash-template-",
        "creation_date":"1536308233761",
        "number_of_replicas":"0",
        "uuid":"EnriugFrTS-999O0F1Hk_g",
        "version":{  
           "created":"6040099"
        }
     }
  }

}
}

3

please help

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.