Elasticsearch の index templates で解析方法を指定する（または、default mapping が効かない時に） ref: http://qiita.com/yosisa/items/b0bb44548bbd527005cc

file0.txt

{
  "template": "accesslog-*",
  "mappings": {
    "fluent": {
      "properties": {
        "host": {
          "type": "string",
          "index": "not_analyzed"
        },
        "uri": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

file1.txt

<match pyfluent.**>
  type elasticsearch
  host localhost
  port 9200
  logstash_format true
  logstash_prefix accesslog
  type_name fluent
  include_tag_key true
  tag_key @tag
  flush_interval 5s
</match>

file2.txt

{"host": "127.0.0.1", "uri": "/users/1", "method": "GET", ...}

file3.txt

{
  "accesslog": {
    "template": "accesslog-*",
    "mappings": {
      "fluent": {
        "properties": {
          "host": {
            "type": "string",
            "index": "not_analyzed"
          },
          "uri": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    }
  }
}