Template creates file.file.raw, message.message.raw etc


(Mike-4) #1

hi,

i want to set fields of a specific index to "not_analyzed". I took https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json

changed

{

"template" : "logstash-*",

to my index name

{

"template" : "applogs-*",

and referenced this file in logstash

   several outputs
   .....
    if [type] == "applogs" {
   elasticsearch {
    host => "127.0.0.1"
    cluster =>"logstash"
    index => "applogs-%{+YYYY.MM.dd}"
    template => "/etc/logstash/templates/mapping.json"
    template_overwrite => true
    template_name => "applogs"
   }
}

deleted the old index and restarted everything.

The "Settings" page in kibana is now showing

file.file.raw 
message.message.raw 

etc. for this index.

What*s wrong?

logstash 1.5.0
kibana 4.1.0
elasticsearch 1.5.2

Thx

Mike

update

curl localhost:9200/applogs-2015.06.29/

shows file.raw so it seems to be fine. maybe a kibana bug


(system) #2