hi,
i want to set fields of a specific index to "not_analyzed". I took https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json
changed
{
"template" : "logstash-*",
to my index name
{
"template" : "applogs-*",
and referenced this file in logstash
several outputs
.....
if [type] == "applogs" {
elasticsearch {
host => "127.0.0.1"
cluster =>"logstash"
index => "applogs-%{+YYYY.MM.dd}"
template => "/etc/logstash/templates/mapping.json"
template_overwrite => true
template_name => "applogs"
}
}
deleted the old index and restarted everything.
The "Settings" page in kibana is now showing
file.file.raw
message.message.raw
etc. for this index.
What*s wrong?
logstash 1.5.0
kibana 4.1.0
elasticsearch 1.5.2
Thx
Mike
update
curl localhost:9200/applogs-2015.06.29/
shows file.raw so it seems to be fine. maybe a kibana bug