Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
@fields separated, date analyzed and 2 time-formats
curl -XPUT http://10.0.4.24:9200/_template/logstash -d '
{
"template" : "logstash*",
"settings" : {
"number_of_shards" : 1,
"index.refresh_interval" : "10s",
"index.query.default_field": "@message"},
"mappings": {
"_default_": {
"_all": { "enabled": false },
"_source": { "compress": false },
"properties": {
"@fields" : {
"properties" : {
"date": { "type": "date", "format": "MMM dd HH:mm:ss||MMM d HH:mm:ss", "index": "analyzed" },
"host": { "type": "string", "index": "not_analyzed" },
"service": { "type": "string", "index": "not_analyzed" },
"program": { "type": "string", "index": "not_analyzed" },
"pid": { "type": "integer", "index": "not_analyzed" },
"message": { "type": "string", "index": "analyzed" }
} },
"@message": { "type": "string", "index": "analyzed" },
"@source": { "type": "string", "index": "not_analyzed" },
"@source_host": { "type": "string", "index": "not_analyzed" },
"@source_path": { "type": "string", "index": "not_analyzed" },
"@tags": { "type": "string", "index": "not_analyzed" },
"@timestamp": { "type": "date", "index": "not_analyzed" },
"@type": { "type": "string", "index": "not_analyzed" }
} } } }'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.