Logstash弹性搜索输出自定义模板不起作用

Question

My logstash config is something like the following

if "user" in [tags] {
        elasticsearch {
            hosts => ["localhost:9200"]
            action => "index"
            index => "user-%{+YYYY.MM.dd}"
            template => '/path/to/elastic-template.json'
            flush_size => 50
        }
}    

And the json template contains the lines

 "fields" : {
                 "{name}" : {"type": "string", "index" : "analyzed", "omit_norms" : true, "index_options" : "docs"},
                 "{name}.raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }

So I assume the .raw can be used when searching or generating the visualization.

However, I removed the existing index and rebuild again, I can see the data, but I still cannot find the .raw field either Kibana's settings, discover or visualize

How to use the .raw field?

Answer 1

The template you posted isn't even valid JSON. If you want to apply a raw field as in not_analyzed you have to do it like this:

"action" : {
  "type" : "string",
    "fields" : {
      "raw" : {
        "index" : "not_analyzed",
        "type" : "string"
    }
  }
}

This will create a action.raw field.

Answer 2

I encountered same issue. I used ES5.5.1 and logstash 5.5.1 , below is my template file

{
  "template": "access_log",
  "settings": {
    "index.refresh_interval" : "5s"
  },
  "mappings": {
    "log": {
      "properties":{
        "geoip":{
          "properties":{
             "location" : {
               "type" : "geo_point",
               "index": "false"
             }
          }
        }
      }
    }
  }
}