Providing multiple path_unmatch while defining dynamic templates

Elastic Stack Elasticsearch
1

Hi,

We can define a dynamic template like:

            {
                "fields_template" : {
                    "mapping": { "type": "string", "index":

"not_analyzed" },
"path_match": "@fields.*",
"path_unmatch": "@fields.size"
}
}

Is there a way to define multiple path_unmatch? I've a requirement where I
need to exclude more than one fields from that regex but I also can't give
away with regex in path_match.

What are my options?

--
Regards,
Abhijeet Rastogi (shadyabhi)

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

I am not sure I fully understand the reasons why you cannot use regex match
for both path_match and path_unmatch. Could you elaborate on this?

On Friday, April 5, 2013 4:09:29 PM UTC-4, Abhijeet Rastogi wrote:

Hi,

We can define a dynamic template like:

            {   
                "fields_template" : { 
                    "mapping": { "type": "string", "index":

"not_analyzed" },
"path_match": "@fields.*",
"path_unmatch": "@fields.size"
}
}

Is there a way to define multiple path_unmatch? I've a requirement where I
need to exclude more than one fields from that regex but I also can't give
away with regex in path_match.

What are my options?

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Hi Igor,

Sorry for late reply. The reply got missed in filters and I wasn't
notified. My current template looks like: http://pb.abhijeetr.com/RiUH and
indices are created with the name "logstash-date-here".

These are basically logs and text from logs is parsed and corresponding
fields are created. My aim is to not analyse all "@fields.*" but specify
analyzers for only the fields I want, in the above template (
http://pb.abhijeetr.com/RiUH), "@fields.syslog_message" (want it whitespace
analyzed) & "@fields.size". (want it to be a long so that I can use
term_stats facets).

Another issue that's popping up while using this template is,
http://stackoverflow.com/questions/16078561/getting-infinity-and-infinity-in-terms-stats-query,
I feel like the way I'm specifying @fields.size as long is messy.

On Mon, Apr 8, 2013 at 11:14 PM, Igor Motov imotov@gmail.com wrote:

I am not sure I fully understand the reasons why you cannot use regex
match for both path_match and path_unmatch. Could you elaborate on this?

On Friday, April 5, 2013 4:09:29 PM UTC-4, Abhijeet Rastogi wrote:

Hi,

We can define a dynamic template like:

            {
                "fields_template" : {
                    "mapping": { "type": "string", "index":

"not_analyzed" },
"path_match": "@fields.*",
"path_unmatch": "@fields.size"
}
}

Is there a way to define multiple path_unmatch? I've a requirement where
I need to exclude more than one fields from that regex but I also can't
give away with regex in path_match.

What are my options?

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

Dynamic templates are applied only to fields that are created dynamically.
In other words, if a field is already defined in the mappings (in the
properties sections), it is not affected by dynamic templates in any way.
So, you don't need to list such fields in "path_unmatch".

On Thursday, April 18, 2013 5:59:17 AM UTC-4, Abhijeet Rastogi wrote:

Hi Igor,

Sorry for late reply. The reply got missed in filters and I wasn't
notified. My current template looks like: http://pb.abhijeetr.com/RiUHand indices are created with the name "logstash-date-here".

These are basically logs and text from logs is parsed and corresponding
fields are created. My aim is to not analyse all "@fields.*" but specify
analyzers for only the fields I want, in the above template (
http://pb.abhijeetr.com/RiUH), "@fields.syslog_message" (want it
whitespace analyzed) & "@fields.size". (want it to be a long so that I can
use term_stats facets).

Another issue that's popping up while using this template is,
http://stackoverflow.com/questions/16078561/getting-infinity-and-infinity-in-terms-stats-query, I feel like the way I'm specifying @fields.size as long is messy.

On Mon, Apr 8, 2013 at 11:14 PM, Igor Motov <imo...@gmail.com<javascript:>

wrote:

I am not sure I fully understand the reasons why you cannot use regex
match for both path_match and path_unmatch. Could you elaborate on this?

On Friday, April 5, 2013 4:09:29 PM UTC-4, Abhijeet Rastogi wrote:

Hi,

We can define a dynamic template like:

            {   
                "fields_template" : { 
                    "mapping": { "type": "string", "index":

"not_analyzed" },
"path_match": "@fields.*",
"path_unmatch": "@fields.size"
}
}

Is there a way to define multiple path_unmatch? I've a requirement where
I need to exclude more than one fields from that regex but I also can't
give away with regex in path_match.

What are my options?

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
For more options, visit https://groups.google.com/groups/opt_out.

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

5

Hi Igor,

I observed differently than what you said. Please have a look at this post
http://elasticsearch-users.115913.n3.nabble.com/Getting-Infinity-and-Infinity-in-terms-stats-query-What-does-it-mean-tp4033518p4033639.html

It's another post you replied in.

On Fri, Apr 19, 2013 at 3:04 AM, Igor Motov imotov@gmail.com wrote:

Dynamic templates are applied only to fields that are created dynamically.
In other words, if a field is already defined in the mappings (in the
properties sections), it is not affected by dynamic templates in any way.
So, you don't need to list such fields in "path_unmatch".

On Thursday, April 18, 2013 5:59:17 AM UTC-4, Abhijeet Rastogi wrote:

Hi Igor,

Sorry for late reply. The reply got missed in filters and I wasn't
notified. My current template looks like: http://pb.abhijeetr.com/RiUHand indices are created with the name "logstash-date-here".

These are basically logs and text from logs is parsed and corresponding
fields are created. My aim is to not analyse all "@fields.*" but specify
analyzers for only the fields I want, in the above template (
http://pb.abhijeetr.com/RiUH), "@fields.syslog_message" (want it
whitespace analyzed) & "@fields.size". (want it to be a long so that I can
use term_stats facets).

Another issue that's popping up while using this template is,
http://stackoverflow.com/**questions/16078561/getting-**
infinity-and-infinity-in-**terms-stats-queryhttp://stackoverflow.com/questions/16078561/getting-infinity-and-infinity-in-terms-stats-query, I feel like the way I'm specifying @fields.size as long is messy.

On Mon, Apr 8, 2013 at 11:14 PM, Igor Motov imo...@gmail.com wrote:

I am not sure I fully understand the reasons why you cannot use regex
match for both path_match and path_unmatch. Could you elaborate on this?

On Friday, April 5, 2013 4:09:29 PM UTC-4, Abhijeet Rastogi wrote:

Hi,

We can define a dynamic template like:

            {
                "fields_template" : {
                    "mapping": { "type": "string", "index":

"not_analyzed" },
"path_match": "@fields.*",
"path_unmatch": "@fields.size"
}
}

Is there a way to define multiple path_unmatch? I've a requirement
where I need to exclude more than one fields from that regex but I also
can't give away with regex in path_match.

What are my options?

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@**googlegroups.com.

For more options, visit https://groups.google.com/**groups/opt_outhttps://groups.google.com/groups/opt_out
.

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Regards,
Abhijeet Rastogi (shadyabhi)
http://blog.abhijeetr.com

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.