Field not analyzing

[gsmith]

Hello,

@MalinkinSA

And we can’t search by the custom field without * or fulltext searching.
How we can change it?

Could you show your configurations and to be honest, I have no clue why this is happing to you.

@MalinkinSA

But all field what was created by this grok - not analyzed.

Could you explain in greater detail about this?

@MalinkinSA

I tried change index template, but after index rotation all my changes lost.

There might be some information in here about indices.

Upgrading to Elasticsearch 7.10 / problem with custom index template

@H2Cyber @zoulja The Graylog documentation prescribes this as a template: { "template": "graylog_*", "mappings" : { "message" : { "properties" : { "http_method" : { "type" : "keyword" }, "http_response_code" : { "type" : "long" }, "ingest_time" : { "type" : "date", "format": "strict_date_time" }, "took_ms" : { "type" : "long" } } } } } With ES 6.8 this wo…