Hello,
I'm using http_poller to bring some info from an API to ES. My output config looks like this.
output {
if [type] == 'ServerPool'{
elasticsearch {
hosts => "localhost:9200"
index => "ovm-%{+YYYY.MM.dd}"
document_type => "%{[type]}" #server,vm,etc
template => "/etc/logstash/templates/ovm-template.json"
template_name => "ovm"
template_overwrite => true
}
}
}
And my template is somewhat like this:
{
"template" : "ovm-*",
"mappings" : {
"_default" : {
"_all" : {
"enabled" : false
},
"properties" : {
"id" : {
"properties" : {
"type" : {"type" : "keyword"},
"value" : {"type" : "keyword"},
"uri" : {"type" : "keyword"},
"name" : {"type" : "keyword"}
},
"name" : {"type" : "keyword"},
"description" : {"type" : "text"},
"generation" : {"type" : "long"}
}
}
},
// A Server Pool is a grouping of associated Servers and Vms that may run on those Servers. It also acts as a container for other associated objects such as Affinity Groups.
"ServerPool" : {
"properties" : {
"@timestamp" : {"type" : "date"},
"project" : {"type" : "keyword"},
"environment" : {"type" : "keyword"},
.
.
.
For some reason, after I index some documents, if I query the mappings for this index, all my "keyword" types are also being stored as a text mapping too.
curl -XGET 'localhost:9200/ovm-*/_mapping/ServerPool?pretty'
{
"ovm-2017.03.28" : {
"mappings" : {
"ServerPool" : {
"properties" : {
"id" : {
"properties" : {
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"type" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
.
.
.
I can see the duplicated fields in kibana too, for example, 'ïd.name" and "id.name.keyword". How can I just store the fields as "keywords", what else do I have to do in my template for this to work?
Thank you,
N