Changing the Extractors field mapping

Zerobot · February 7, 2019, 7:19am

Hi!

Is it possible to change the mapping which extractors are creating in elasticsearch indices? For example I don’t want field “TEST_1” to be of type “keyword”, I need it to be “text” only because it has more than 32KB. How can I achieve that in Graylog?

jan · February 7, 2019, 8:51am

that is done via the custom field mapping in elasticsearch and not in graylog

Topic		Replies	Views
Custom mapping not applied to indices Graylog Central (peer support)	5	3145	December 3, 2019
Extractor key=value field type hints Graylog Central (peer support) pipeline-rules	4	1683	June 5, 2020
Can we use Elasticsearch false or strict with Graylog? Graylog Central (peer support)	8	1708	May 29, 2019
Replace Default Index Mapping Graylog Central (peer support) pipeline-rules , sidecar , winlogbeat	2	1168	September 23, 2020
GROK extractor field data types and how they relate to ElasticSearch field data types Graylog Central (peer support)	4	4633	June 27, 2018

Changing the Extractors field mapping

Related topics