Dynamic template

my dynamic template , as follow:

“dynamic_templates”: [

{

“strings_as_keyword”: {

“match_mapping_type”: “string”,

“match”: “*”,

“unmatch”: [“message”,"*id"],

“mapping”: {

“type”: “keyword”

}

}

},

{

“message_as_text”: {

“match_mapping_type”: “string”,

“match”: “message”,

“mapping”: {

“type”:“text”

}

}

},

{

“prefix_id_as_integer”: {

“match_mapping_type”: “string”,

“match”: ["*id"],

“mapping”: {

“type”:“integer”

}

}

}

],
however, I get the /logstash-audit-/audit/_mapping

“dynamic_templates”: [

{

“strings_as_keyword”: {

“match”: “
”,

“unmatch”: “[message, *id]”,

“match_mapping_type”: “string”,

“mapping”: {

“type”: “keyword”

}

}

},

{

“message_as_text”: {

“match”: “message”,

“match_mapping_type”: “string”,

“mapping”: {

“type”: “text”

}

}

},

{

“prefix_id_as_integer”: {

“match”: “[id]”,

“match_mapping_type”: “string”,

“mapping”: {

“type”: “integer”

}

}

},

{

“message_field”: {

“path_match”: “message”,

“match_mapping_type”: “string”,

“mapping”: {

“norms”: false,

“type”: “text”

}

}

},

{

“string_fields”: {

“match”: “
”,

“match_mapping_type”: “string”,

“mapping”: {

“fields”: {

“keyword”: {

“ignore_above”: 256,

“type”: “keyword”

}

},

“norms”: false,

“type”: “text”

}

}

}

],

I’m so confused, i never configured message_field and string_field.

Please format your code using </> icon as explained in this guide. It will make your post more readable and will help us help you.
Alternatively use markdown style like this:

```
CODE
```

thanks for your reply, my dynamic template, as follow:

"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"match": "*",
"unmatch": ["message","*id"],
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match_mapping_type": "string",
"match": "message",
"mapping": {
"type":"text"
}
}
},
{
"prefix_id_as_integer": {
"match_mapping_type": "string",
"match": ["*id"],
"mapping": {
"type":"integer"
}
}
}
],

however, I get the /logstash-audit-/audit/_mapping

"dynamic_templates": [
{
"strings_as_keyword": {
"match": "",
"unmatch": "[message, *id]",
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"message_as_text": {
"match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text"
}
}
},
{
"prefix_id_as_integer": {
"match": "[id]",
"match_mapping_type": "string",
"mapping": {
"type": "integer"
}
}
},
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],

What’s the question or problem you are trying to resolve?

i configure the dynamic template, including three fields: strings_as_keyword, message_as_text and prefix_id_as_integer.

but when i check the indice’s mapping, it’s dynamic template have five fields:strings_as_keyword, message_as_text,prefix_id_as_integer, message_field and string_fields. i wonder why this happen

You have dynamic mappings enabled, so if there are other fields that Elasticsearch see, it will automatically accept and create them, which means also adding to the mapping.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.