Changing the Extractors field mapping

(Zero) #1


Is it possible to change the mapping which extractors are creating in elasticsearch indices? For example I don’t want field “TEST_1” to be of type “keyword”, I need it to be “text” only because it has more than 32KB. How can I achieve that in Graylog?

(Jan Doberstein) #2

that is done via the custom field mapping in elasticsearch and not in graylog

(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.