geekpete

### Path Hierarchy Examples

DELETE /file-path-test/


# create mapping with file_path text field and two subfields for file path tree to be analyzed in two different ways using custom analyzers.
# field <- customer analyzer <- customer tokenizer <- path_hierarchy tokenizer
# 
PUT /file-path-test/
{

geekpete

Problem:  We have a log line that includes a perl class that we want to log the class 
and method in their respected fields.  An example class and method in perl:

Animal::Dog::bark

In this example, "bark" is the method.  "Animal::Dog" is the class.

After some searching and hacking, I found a solution that works with Logstash 1.4.2

Assume the input is "Animal::Dog::bark".

geekpete

# based on the v6 docs for parent-join
# https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html

DELETE /my_index
DELETE /my_index-new

PUT my_index
{
  "mappings": {
    "doc": {

geekpete

### Keybase proof

I hereby claim:

  * I am geekpete on github.
  * I am geekpete (https://keybase.io/geekpete) on keybase.
  * I have a public key ASDGWhEt45Mpu9NrvY2k_y4OJm29hE1q0If-iYMIu9rqZQo

To claim this, I am signing this object:

geekpete

# ensure library index is removed if doing repeated testing
DELETE /library

# add the sample data
PUT library/book/1
{
"title": "demian",
"writer" : "Hermann Hesse",
"edition" : 1,
"contents" : "We have been playing with adding new facets to search on the Marketplaces"

geekpete

# ensure the test index is deleted if we've tested previously
DELETE /my_index/

# create the index with two nested fields
PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "user": {

geekpete

"If you want to filter _source fields, you should consider combining the already existing _source parameter (see Get API for more details) with the filter_path parameter"


Response Filtering (filter_path):
https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#common-options-response-filtering

Source Filtering:
https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-get.html#get-source-filtering

geekpete

GET /birthday/_search

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },

geekpete

{
  "from": 0,
  "size": 10,
  "timeout": "10s",
  "query": {
    "bool": {
      "must": [
        {
          "multi_match": {
            "query": "test",

geekpete

# dynamic mapping, true vs false vs strict
#
# First review the short section of documentation around this functionality as it will aid in understanding:
# https://www.elastic.co/guide/en/elasticsearch/reference/2.4/dynamic.html
#
# This entire example can be pasted into Sense (now called Console inside the Dev Tools section of Kibana since 5.0)
# and each command run, beware that this will create indices in the Elasticsearch cluster that Kibana is pointed at,
# but should not affect existing indices.
#
# TODO: need to add some examples of how document fields are searchable/aggregateable or not.