Is it possible to set custom mapping for index in logstash but not in elasticsearch?

Question

There's input, filter and then output in Logstash main coding.

Is it possible to set custom mapping in

output
    { elasticsearch {

}

If it is possible, how do I set it? With this example:

    "mappings" : {
  "_default_" : {
   "properties" : {
"service" : { "type" : "integer" },
"rule" : { "type" : "integer" },
"ICMP Type" : { "type" : "integer" },
"ICMP Code" : { "type" : "integer" },
"ip_offset" : { "type" : "integer" },
"ip_id" : { "type" : "integer" },
"ip_len" : { "type" : "integer" },
"Confidence Level" : { "type" : "integer" },
"fragments_dropped" : { "type" : "integer" },
"Severity" : { "type" : "integer" },
"serial_num" : { "type" : "integer" },
"during_sec" : { "type" : "integer" },
"Attack info" : {"type": "string", "index" : "not_analyzed" },
"peer gateway" : {"type": "string", "index" : "not_analyzed" }

Alain Collins · Accepted Answer · 2015-08-20 07:40:20Z

1

Logstash comes with a default template that is used when writing documents to elasticsearch.

If you'd like to change the default, you can update your config and pass it the location of a template file.

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template

answered Aug 20, 2015 at 7:40

Alain Collins

16.4k2 gold badges34 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mherbert · Accepted Answer · 2015-08-20 07:47:24Z

0

You can use template and template_overwrite fields like that :

 elasticsearch {
    template => "/tttttttttttt/elasticsearch-logstash-template.json"
    index => "logstash-%{+YYYY.MM.dd}"
    cluster=>"cluster"
    template_overwrite => true
}

answered Aug 20, 2015 at 7:47

mherbert

5253 silver badges12 bronze badges

Collectives™ on Stack Overflow

Is it possible to set custom mapping for index in logstash but not in elasticsearch?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related