[version 7.1.1] When I set the type of some fields to 'keyword' by ES mapping , it doesn't work

[francis-oyc (Francis)]

Recently, I have built an ELK system, I wat to set the type of some fields to 'keyword' by ES mapping , but it doesn't work.Here is my ES mapping :
PUT /_template/francis-template
{
"index_patterns": [""],
"version" : 60001,
"order": "10",
"settings": {
"index": {
"number_of_shards": "1",
"number_of_replicas": "0",
"refresh_interval": "10s"
}
},
"mappings": {
"dynamic_templates": [
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"dates": {
"match": "*Time",
"match_mapping_type": "string",
"mapping": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss.SSS"
}
}
},
{
"dates": {
"match": "*Date",
"match_mapping_type": "string",
"mapping": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss.SSS"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"appName": {
"type": "keyword"
},
"className": {
"type": "keyword"
},
"exportable": {
"type": "keyword"
},
"logLevel": {
"type": "keyword"
},
"message": {
"type": "keyword"
},
"parentId": {
"type": "keyword"
},
"pid": {
"type": "keyword"
},
"spanId": {
"type": "keyword"
},
"thread": {
"type": "keyword"
},
"traceId": {
"type": "keyword"
}
}
}
}
}

after put the mapping , I deleted all the indexes and then created a new index, when I cliked the new index's mapping , I found my settings doesn't work. Here is the screen shot :

For example, I just want to set the type of appName to 'keyword' , but it is still 'text', I don't how to solve it now, please help me , thanks !

[HenningAndersen]

@francis-oyc,

updating the type of fields is not possible, since all existing data would not be indexed in the way reflected by the new type.

Instead you would have to reindex your data to a new index with the corrected mapping.

Notice that text data is by default indexed both as text and keyword, thus you can use the appName.keyword field for an exact match keyword query.

[francis-oyc (Francis)]

If I don't want to reindex my data to a new index ，when I set the output properties for Logstash ，could I specify a custom template to overrite the default template ？And does it work？

[francis-oyc (Francis)]

My step is : First， I put the mapping in Kibana. Second， I deleted all existing indexes，and then created a new index. So I don't think there's any data existed. My purpose is : Logs outputted from Logstash to Elasticsearch，index mapping would be created according to the type that I set，but it's not.

[francis-oyc (Francis)]

I have solved this problem , thanks !