Template for logstash indexes
{ | |
"template": "logstash-*", | |
"settings" : { | |
"index.number_of_shards" : 3, | |
"index.number_of_replicas" : 1, | |
"index.query.default_field" : "@message", | |
"index.routing.allocation.total_shards_per_node" : 2, | |
"index.auto_expand_replicas": false | |
}, | |
"mappings": { | |
"_default_": { | |
"_all": { "enabled": false }, | |
"_source": { "compress": false }, | |
"dynamic_templates": [ | |
{ | |
"fields_template" : { | |
"mapping": { "type": "string", "index": "not_analyzed" }, | |
"path_match": "@fields.*" | |
} | |
}, | |
{ | |
"tags_template" : { | |
"mapping": { "type": "string", "index": "not_analyzed" }, | |
"path_match": "@tags.*" | |
} | |
} | |
], | |
"properties" : { | |
"@fields": { "type": "object", "dynamic": true, "path": "full" }, | |
"@source" : { "type" : "string", "index" : "not_analyzed" }, | |
"@source_host" : { "type" : "string", "index" : "not_analyzed" }, | |
"@source_path" : { "type" : "string", "index" : "not_analyzed" }, | |
"@timestamp" : { "type" : "date", "index" : "not_analyzed" }, | |
"@type" : { "type" : "string", "index" : "not_analyzed" }, | |
"@message" : { "type" : "string", "analyzer" : "whitespace" } | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment