Why we need to create index template when we can simply define the fields and there datatype in the logstash itself using below syntax:
mutate {convert => ["field_name", "data_type"]
Because Elasticsearch will still map it dynamically, not statically.
Even if you cast something in Logstash as, eg, a number, Elasticsearch might still map it as a string, or even the wrong kind of number type.
1 Like
Oh ok.
I tried loading a csv file data from logstash and the integer type fields got mapped properly from Logstash mutate plugin. Thats when I got this question of why we can't directly do the index mapping in logstash config itself.
Yep that will probably work, but it's not a guarantee unless it's using a mapping in Elasticsearch.
1 Like
Thanks for all the clarification 
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.