Changing the Extractors field mapping


(Zero) #1

Hi!

Is it possible to change the mapping which extractors are creating in elasticsearch indices? For example I don’t want field “TEST_1” to be of type “keyword”, I need it to be “text” only because it has more than 32KB. How can I achieve that in Graylog?


(Jan Doberstein) #2

that is done via the custom field mapping in elasticsearch and not in graylog


(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.