2

I would like to disable all the "raw" fields that are created in Elasticsearch by logstash-forwarder. So if I have a field as "host" logstash-forwarder won't create a "host.raw" field. But I need a general solution for all the string fields.

I have my string fields as "not_analyzed" so having raw fields has no point and just a duplicate of the data.

I tried to remove "fields" part of the mapping below but it's added back after the first log message. The closest thing I could achieve was to add the following mapping but that still creates empty raw fields:

curl -XPUT 'localhost:9200/myindex/' -d '{
    "mappings": {
        "_default_": {
          "dynamic_templates" : [ {
             "string_fields" : {
                "mapping" : {
                "index" : "not_analyzed",
                "type" : "string",
                "fields" : {
                   "raw" : {
                        "ignore_above" : 0,
                        "index" : "not_analyzed",
                        "type" : "string"
                    }
                }
              },
              "match" : "*",
              "match_mapping_type" : "string"
            }
          } ],

        "_all": { "enabled":  false }

        }
    }
}'

So how can I disable these fields?

2

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.