graylog-custom-mapping.json:
{
"graylog-internal" : {
"order" : 0,
"template" : "graylog_*",
"settings" : {
"index" : {
"analysis" : {
"analyzer" : {
"analyzer_keyword" : {
"filter" : "lowercase",
"tokenizer" : "keyword"
}
}
}
}
},
"mappings" : {
"message" : {
"_source" : {
"enabled" : true
},
"dynamic_templates" : [ {
"internal_fields" : {
"mapping" : {
"index" : "not_analyzed",
"type" : "string"
},
"match" : "gl2_*"
}
}, {
"store_generic" : {
"mapping" : {
"index" : "not_analyzed"
},
"match" : "*"
}
} ],
"properties" : {
"full_message" : {
"analyzer" : "standard",
"index" : "no",
"type" : "string"
},
"streams" : {
"index" : "not_analyzed",
"type" : "string"
},
"source" : {
"analyzer" : "analyzer_keyword",
"index" : "analyzed",
"type" : "string"
},
"message" : {
"analyzer" : "standard",
"index" : "analyzed",
"type" : "string"
},
"timestamp" : {
"format" : "yyyy-MM-dd HH:mm:ss.SSS",
"type" : "date"
}
}
}
},
"aliases" : { }
}
}
And I load the index mapping into Elasticsearch:
$ curl -X PUT -d @'graylog-custom-mapping.json' 'http://localhost:9200/_template/graylog-custom-mapping?pretty'
Is the good practice ?
Thx