2

I would like to disable all the "raw" fields that are created in Elasticsearch by logstash-forwarder. So if I have a field as "host" logstash-forwarder won't create a "host.raw" field. But I need a general solution for all the string fields.

I have my string fields as "not_analyzed" so having raw fields has no point and just a duplicate of the data.

I tried to remove "fields" part of the mapping below but it's added back after the first log message. The closest thing I could achieve was to add the following mapping but that still creates empty raw fields:

curl -XPUT 'localhost:9200/myindex/' -d '{
    "mappings": {
        "_default_": {
          "dynamic_templates" : [ {
             "string_fields" : {
                "mapping" : {
                "index" : "not_analyzed",
                "type" : "string",
                "fields" : {
                   "raw" : {
                        "ignore_above" : 0,
                        "index" : "not_analyzed",
                        "type" : "string"
                    }
                }
              },
              "match" : "*",
              "match_mapping_type" : "string"
            }
          } ],

        "_all": { "enabled":  false }

        }
    }
}'

So how can I disable these fields?

Balazs Varhegyi
  • 991
  • 1
  • 18
  • 37
  • 1
    Do the answers in http://stackoverflow.com/questions/27483302/change-default-mapping-of-string-to-not-analyzed-in-elasticsearch/ help? – Magnus Bäck Mar 09 '15 at 13:51
  • 1
    Thank you @MagnusBäck so much for pointing that out! Somehow I've missed this thread. This http://stackoverflow.com/a/27484723/1559672 didn't but http://stackoverflow.com/a/27502037/1559672 solved the issue. – Balazs Varhegyi Mar 09 '15 at 14:28

0 Answers0