Template mapping not being applied

Elastic Stack Elasticsearch
1

Hello

I am currently setting a mapping in my template but it seems to not be working.

My work flow is basically

Data -> Logstash -> Elasticsearch

In Logstash, I do NOT set a template SO it gets the default, which is under "Legacy index templates" called "logstash".

Under this template, Ive applied the mapping, so I am not sure why it doesnt work.

If I delete the index, force a mapping and then copy it back, it does indeed work but this isnt ideal to set for example in a cron.

There is something I am missing (probably obvious) but Im not seeing it right now.

Can someone lend a hand?

Thanks

2

Does your index names match what is specified in the template?

3

When I create a index, a default template is picked up, correct? So it shouldnt matter what it is named.

4

The template contains a field that specified which indices it applies to. If your index does not match this the template will not be applied. It would help if you showed the parts of the index template that does not specify mappings.

5

Do you mean this:

{
  "_doc": {
	"dynamic_templates": [
	  {
		"message_field": {
		  "path_match": "message",
		  "mapping": {
			"norms": false,
			"type": "text"
		  },
		  "match_mapping_type": "string"
		}
	  },
	  {
		"string_fields": {
		  "mapping": {
			"norms": false,
			"type": "text",
			"fields": {
			  "keyword": {
				"ignore_above": 256,
				"type": "keyword"
			  }
			}
		  },
		  "match_mapping_type": "string",
		  "match": "*"
		}
	  }
	],
	"properties": {
	  "@timestamp": {
		"type": "date"
	  },
	  "geoip": {
		"dynamic": true,
		"properties": {
		  "ip": {
			"type": "ip"
		  },
		  "latitude": {
			"type": "half_float"
		  },
		  "location": {
			"type": "geo_point"
		  },
		  "longitude": {
			"type": "half_float"
		  }
		}
	  },
	  "@version": {
		"type": "keyword"
	  }
	}
  }
}

?

Else, sorry, but Im not understanding you

6

I implemented a workaround that seems to work...........I dont think its the solution but.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.