0

I'm using the below mapping where the payload.body field will contain json as a string. i want to get rid of all the braces, quotes colons e.t.c from the json and leave out only the keys [the values will be empty string all the time]. but for some reason the char mapping is not working

e.g. {"query": {match_all: ''}} returns querymatch_all. it should return query match_all

{
  "order": 0,
  "template": "custom_stats*",
  "settings": {
    "index": {
      "analysis": {
        "analyzer": {
          "query_logging_analyzer": {
            "char_filter": [
              "json_entites"
            ],
            "tokenizer": "whitespace"
          }
        },
        "char_filter": {
          "json_entites": {
            "type": "mapping",
            "mappings": [
              "{=> ",
              "}=> ",
              "'=> ",
              "\"=> ",
              ":=> ",
              ",=> ",
              "[=> ",
              "]=> "
            ]
          }
        }
      }
    }
  },
  "mappings": {
    "logs": {
      "properties": {
        "payload": {
          "properties": {
            "body": {
              "index": "not_analyzed",
              "type": "string",
              "fields": {
                "features": {
                  "analyzer": "query_logging_analyzer",
                  "type": "string"
                }
              }
            }
          }
        }
      }
    }
  },
  "aliases": {}
}
ffff
  • 2,853
  • 1
  • 25
  • 44
  • You don't need this custom analyzer, the standard analyzer should work in this case. – MartinSchulze Jul 03 '18 at 13:36
  • 3
    Possible duplicate of [Elasticsearch char\_filter replace any character with whitespace?](https://stackoverflow.com/questions/15501517/elasticsearch-char-filter-replace-any-character-with-whitespace) – Pierre Mallet Jul 03 '18 at 14:17

0 Answers0