2

I am new to this technology stack and I don't really know where to start.

I have a field named application_name, I have values with spaces, e.g. "app android", "app ios". What is the easiest logstash-elasticsearch configuration to have two terms, namely "app android" and "app ios" instead of "app", "android" and "ios"?

lingo_journey
  • 653
  • 1
  • 8
  • 22
  • [This](http://stackoverflow.com/questions/20384374/elastic-search-for-terms-with-spaces) *might* answer your question – GPPK Feb 20 '14 at 12:32

1 Answers1

0

You need to create a index template (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/indices-templates.html) that sets the field you don't want to tokenize to "index": "not_analyzed"

You can also create a template that turns every string field not_analyzed by default -- for an example of this, see: https://gist.github.com/deverton/2970285

Alcanzar
  • 16,985
  • 6
  • 42
  • 59