Logstash复制模板属性

Question

I'm trying to set a custom template for a specific index. The issue is when I create it in Kibana, I see some duplicated properties such as type and _type (with the "_"). I've been trying different template "approaches" but without success... Also, I guess the default template keeps overriding the custom one.

This is my output configuration:

output {
  if [type] == "something" {
    elasticsearch {
      (... omitted ...)
      manage_template => true
      index => "log-%{+YYYY.MM.dd}"
      template_name => "log-template"
      template => "/etc/logstash/templates.d/log.json"
      template_overwrite => true
    }
  }

The following is my template file:

{
  "template": "log-*",
  "order": 1,
  "settings": { "index.refresh_interval": "5s" },
  "mappings":
  {
    "_default_":
      {
        "dynamic": "strict",
        "_all": { "enabled": false },
        "properties":
        {
          "@timestamp": { "type": "date", "format": "dateOptionalTime" },
          "file": { "type": "string" },
          "host": { "type": "string" },
          "host": { "type": "string" }
        }
      }
  }
}

Before I try each new template config I stop logstash, remove all the indexes and templates - just like the official documentation suggests. Only after, I run run logstash and create the index at Kibana.

Answer 1

If you go to Settings > Advanced, you can edit the metaFields setting and only write _source in there, so that _type , _id and _index don't show up anymore:

Then reload your Kibana page and in the Discover tab you'll only see the _source field.