CODEWITHSUNDEEP
elasticsearchmappinglogstashelasticsearch-mapping
hello_its_me
hello_its_me

Reputation: 793

Change Mapping for Field for ALL OF LOGSTASH Created indexes

I would like to change the type of the field location to geo_point. I'm using ES with Logstash, as y'all know, indices are generated with the name logstash-yyyy-mm-dd

I first created a logstash index and named it logstash-2016-03-29, like so:

curl -XPUT 'http://localhost:9200/logstash-2016-03-29'

then, I changed the mapping for supposedly all the indices called Logstash-* using the following:

curl -XPOST "http://localhost:9200/logstash-*/_mapping/logs" -d '{
"properties" : {
            "location" : { "type":"geo_point" }
        }
}'

And when I ran the Logstash configuration file, all the location fields in the index logstash-2016-03-29 were indeed of type geo_point.

However, today, the auto-generated index logstash-2016-03-30 had field location of type String instead of geo_point. I thought the type should be applied on ANY index that starts with the name logstash-*. Apparently, I was wrong. How can I fix this so that any future index created by logstash that have the location field would have that field type set to geo_point instead of String?

Thanks.

Upvotes: 1

Views: 283

Answers (1)

Hugo
Hugo

Reputation: 254

You should define it using the index template

curl -XPUT localhost:9200/_template/template_2 -d '
{
    "template" : "logstash-",
    "mappings" : {
        "logs" : {
          "properties": {
            "location" : { "type" : "geo_point" }
           }
        }
    }
}

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

Upvotes: 1

Related Questions