Use standard analyzer for specific field in template

Elastic Stack Elasticsearch
1

Hi,

i am trying to create a custom analyzer for a field messagep in the template to get tokens out of the message. below is my template. i am not able to tokenize the input field. anything extra needs to be done?

{
"template" : "logstash-",
"version" : 50001,
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"default" : {
"_all" : {"enabled" : true, "norms" : false},
"dynamic_templates" : [ {
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
}, {
"string_fields" : {
"match" : "",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text", "norms" : false,
"fields" : {
"keyword" : { "type": "keyword" }
}
}
}
},{
"string_fields" : {
"match" : "messagep",
"match_mapping_type" : "*",
"mapping" : {
"type" : "string",
"fields" : {
"messagep": {
"type" : "string",
"analyzer":"standard",
"tokenizer":"standard"
},
"raw": {
"type" : "string",
"analyzer":"standard",
"tokenizer":"standard"
}
}

      }
    }
  }],
  "properties" : {
    "@timestamp": { "type": "date", "include_in_all": false },
    "@version": { "type": "keyword", "include_in_all": false },
    "geoip"  : {
      "dynamic": true,
      "properties" : {
        "ip": { "type": "ip" },
        "location" : { "type" : "geo_point" },
        "latitude" : { "type" : "half_float" },
        "longitude" : { "type" : "half_float" }
      }
    }
  }
}

}
}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.