Dear all,
I am trying to edit the default mapping for APM in order to index labels as text (default is keyword)
My issue is that the dynamic templates doesn't seems to be kept over rollout of the new indices.
I am using ES 7.6.0 and APM server 7.6.0
When I do a _cat/template I have (redacted to templates being applied to apm-*-transaction only):
apm-server-7.6.0 [apm-7.6.0*] 1
apm-7.6.0 [apm-7.6.0*] 1
apm-7.6.0-transaction [apm-7.6.0-transaction*] 2
Doing a GET on apm-server-7.6.0/_mapping gives :
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"container.labels" : {
"path_match" : "container.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"dns.answers" : {
"path_match" : "dns.answers.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"log.syslog" : {
"path_match" : "log.syslog.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"fields" : {
"path_match" : "fields.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"docker.container.labels" : {
"path_match" : "docker.container.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"kubernetes.labels.*" : {
"path_match" : "kubernetes.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "*"
}
},
{
"kubernetes.annotations.*" : {
"path_match" : "kubernetes.annotations.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "*"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "boolean"
},
"match_mapping_type" : "boolean"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
},
"match_mapping_type" : "*"
}
},
{
"transaction.marks" : {
"path_match" : "transaction.marks.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"transaction.marks.*.*" : {
"path_match" : "transaction.marks.*.*",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
},
"match_mapping_type" : "*"
}
},
{
"strings_as_keyword" : {
"mapping" : {
"ignore_above" : 1024,
"type" : "keyword"
},
"match_mapping_type" : "string"
}
}
]
and for GET _template/apm-7.6.0
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"container.labels" : {
"path_match" : "container.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"dns.answers" : {
"path_match" : "dns.answers.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"log.syslog" : {
"path_match" : "log.syslog.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"fields" : {
"path_match" : "fields.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"docker.container.labels" : {
"path_match" : "docker.container.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"kubernetes.labels.*" : {
"path_match" : "kubernetes.labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "*"
}
},
{
"kubernetes.annotations.*" : {
"path_match" : "kubernetes.annotations.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "*"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"type" : "boolean"
},
"match_mapping_type" : "boolean"
}
},
{
"labels" : {
"path_match" : "labels.*",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
},
"match_mapping_type" : "*"
}
},
{
"transaction.marks" : {
"path_match" : "transaction.marks.*",
"mapping" : {
"type" : "keyword"
},
"match_mapping_type" : "string"
}
},
{
"transaction.marks.*.*" : {
"path_match" : "transaction.marks.*.*",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
},
"match_mapping_type" : "*"
}
},
{
"strings_as_keyword" : {
"mapping" : {
"ignore_above" : 1024,
"type" : "keyword"
},
"match_mapping_type" : "string"
}
}
],
My issue is that when the indices is created through rollover (either ILM or manual rollover with empty conditions) the dynamic templates becomes :
{
"labels" : {
"path_match" : "labels.*",
"match_mapping_type" : "double",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
}
}
},
{
"container.labels" : {
"path_match" : "container.labels.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"dns.answers" : {
"path_match" : "dns.answers.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"log.syslog" : {
"path_match" : "log.syslog.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"fields" : {
"path_match" : "fields.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"docker.container.labels" : {
"path_match" : "docker.container.labels.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"kubernetes.labels.*" : {
"path_match" : "kubernetes.labels.*",
"mapping" : {
"type" : "keyword"
}
}
},
{
"kubernetes.annotations.*" : {
"path_match" : "kubernetes.annotations.*",
"mapping" : {
"type" : "keyword"
}
}
},
{
"transaction.marks" : {
"path_match" : "transaction.marks.*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "keyword"
}
}
},
{
"transaction.marks.*.*" : {
"path_match" : "transaction.marks.*.*",
"mapping" : {
"scaling_factor" : 1000000,
"type" : "scaled_float"
}
}
},
{
"strings_as_keyword" : {
"match_mapping_type" : "string",
"mapping" : {
"ignore_above" : 1024,
"type" : "keyword"
}
}
}
],
And this latest mapping consider all labels as being floats.
Do you have any idea of what I am missing to understand how this dynamic mapping is populated ?
Thanks !