2

I am using logstash/elasticsearch/kibana to keep some application logs under control. The application I am working on is custom development so I had to define my patterns/extra file and my own elasticsearch mapping.

The mapping I defined is:

{
    "http-logs": {
        "properties": {
            "message": {
                "type": "string",
                "index": "no"
            },
            "@version": {
                "type": "long"
            },
            "@timestamp": {
                "type": "date"
            },
            "command": {
                "type": "string",
                "index": "not_analyzed"
            },
            "type": {
                "type": "string",
                "index": "analyzed"
            },
            "facade-in": {
                "type": "string",
                "index": "not_analyzed"
            },
            "facade-out": {
                "type": "string",
                "index": "not_analyzed"
            },
            "elapsed": {
                "type": "integer"
            },
            "items": {
                "type": "integer"
            }
        }
    }
}

and once loaded on ES, I can see it defined as expected: ... "command" : { "type" : "string", "index" : "not_analyzed" }, ...

After loading my logs with logstash I am trying to visualize some data but playing aroud with my fields I am puzzled as kibana is saying that my command is analyzed....whereas it should not be.

What am I missing?

Thanks in advance for any help.

krl
  • 31
  • 1
  • 3
  • Did you update the mappings when the index was empty? You can't change the mappings when there already are documents of that type. – Magnus Bäck Mar 03 '15 at 06:42
  • Thanks for the reply. I did update the index but an additional missing step was refreshing the kibana's setting. Not doing so my old analyzed attributes did not move. – krl Mar 04 '15 at 12:55

1 Answers1

1

As already explained here logstash will not rely on your mapping if your documents are not matching it. Doublechecking my objects and my definition the differences caused the problem and cleaning my mapping/objects up did the trick.

Community
  • 1
  • 1
krl
  • 31
  • 1
  • 3