I am having trouble getting my template to apply and am wondering if its because we are using logstash. I am applying the template below and then recreating my index via logstash.
My template is as follows:
PUT /_template/template_defendant
{
"template": "logstash-cns-defendant-v*",
"settings": { "number_of_shards": 1 },
"analysis": {
"analyzer": {
"cns_name_match_analyzer" : {
"tokenizer" : "standard",
"filter" : ["standard", "lowercase", "stop", "porter_stem"],
"stopwords": ["co", "company", "llc", "corporation", "corp"]
}
}
},
"mappings": {
"default": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"type": "string",
"analyzer" : "cns_name_match_analyzer",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed",
"ignore_above": 256
}
}
}
}
}
]
}
}
}
Here is the template from a GET:
GET _template
{
"logstash": {
"order": 0,
"version": 50001,
"template": "logstash-",
"settings": {
"index": {
"refresh_interval": "5s"
}
},
"mappings": {
"default": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
],
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
}
}
}
},
"aliases": {}
},
"template_defendant": {
"order": 0,
"template": "logstash-cns-defendant-v*",
"settings": {
"index": {
"number_of_shards": "1"
}
},
"mappings": {
"default": {
"_all": {
"enabled": false
},
"dynamic_templates": [
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"type": "string",
"analyzer": "cns_name_match_analyzer",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed",
"ignore_above": 256
}
}
}
}
}
]
}
},
"aliases": {}
}
}
I think according to where I got the template code (https://qbox.io/blog/set-analyzers-datatypes-default-mappings-elasticsearch) that I should haw a column called .raw and any string columns should have the analyzer i have defined attached. I am thining i may have to create the template in logstash since i see it the the template on the index but I am not sure. Any guidance would be greatly appreciated.
Thanks!