Hello,
We have a graylog 4.0.7 and for parsing we use Grok patterns extractor. But all field what was created by this grok - not analyzed. And we can’t search by the custom field without * or fulltext searching.
How we can change it? I tried change index template, but after index rotation all my changes lost.
Hm, i think i found solution. I must add type: “text” and analyzer: “standard” for the interesting me field in this custom template and merge it? And this field have a maping for all index where they found?
Hello,
Could you show your configurations and to be honest, I have no clue why this is happing to you.
Could you explain in greater detail about this?
There might be some information in here about indices.
1 Like
Hello, @gsmith
I find solution in custom template mapping, but one monet baffles me. If a want add a few mapping in different indexes i must create this filed in all of this indexes?
@jan
It’s correct that i can’t describe few different templates in graylog-custom-mapping-7x.json?
Instead of GROK can you use regex instead?
I try both, nothing changes, default type - keyword
Can you show what configuration you have made or wanted to make such as Templates and your Grok patterns extractor. In my lab I have created a Grok patterns extractor then rotated my indices and my Grok patterns extractor still created fields I needed. Im not see the same issue as you are. Not knowning how you implemented this it hard to troubleshoot.
No, i speak about another issue.
The field is not lost after rotation. For example i use Grok %{NUMBER:src_port} for extract src_port from event. In elastic, this field was created with type - keyword. And after rotation this field was with keyword type.
But in my case me need switch type of field from keyword to integer, and this i can make only with custom template. But in my cluster i have a few indexes where this field exist and indexes where not exist. And therefore, through custom mapping, when I have to do this field for all my indices
Ok so you modified your default INDEX template and when it rotates you lose that configured mapping keyword --> integer.
I have been working with something like this and the following links helped out a lot.
Then I had to read this to fine turn my knowledge and understand of Elasticsearch.
You might have missed a step.
Hope this helps
Yep, but all fields must describe in graylog-custom-mapping with specified index_pattern.
It’s work, but in my case i must use template as * and all filed created in all new indexes
But it’s better than nothing
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.