Hello,
I have a mapping template here is the snippet:
"mappings": {
"_default_": {
"dynamic_templates": [
{
"string": {
"match": "request",
"mapping": {
"index": "not_analyzed",
"type": "string"
}
}
},
{
"string": {
"match": "http_x_forwarded_for*",
"mapping": {
"index": "not_analyzed",
"type": "string"
}
}
},
when I query mapping for my index that this mapping template applies to, I get the following
{
"my_index" : {
"mappings" : {
"default" : {
"dynamic_templates" : [ {
"string" : {
"mapping" : {
"index" : "not_analyzed",
"type" : "string"
},
"match" : "request"
}
}, {
"string" : {
"mapping" : {
"index" : "not_analyzed",
"type" : "string"
},
"match" : "http_x_forwarded_for*"
}
},
......
"nginx" : {
"dynamic_templates" : [ {
"string" : {
"mapping" : {
"index" : "not_analyzed",
"type" : "string"
},
"match" : "request"
}
}, {
"string" : {
"mapping" : {
"index" : "not_analyzed",
"type" : "string"
},
"match" : "http_x_forwarded_for*"
}
},
......
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
"@version" : {
"type" : "string"
},
"http_x_forwarded_for" : {
"type" : "string",
"index" : "not_analyzed"
},
"http_x_forwarded_for1" : {
"type" : "string"
},
"http_x_forwarded_for2" : {
"type" : "string"
},
"request" : {
"type" : "string"
},
shouldn't I have all fields that match http_x_forwarded_for be not_analyzed and why request not set to not_analyzed in the properties section.