Changing the Extractors field mapping


Is it possible to change the mapping which extractors are creating in elasticsearch indices? For example I don’t want field “TEST_1” to be of type “keyword”, I need it to be “text” only because it has more than 32KB. How can I achieve that in Graylog?

that is done via the custom field mapping in elasticsearch and not in graylog

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.