Configuring default Index Mappings (_default_ properties) in Logstash

Index fields are indexed using automatic detection in ES, such as IP, date auto-detection (default on), Auto-detect (default off) for dynamic mapping to automatically index documents, and when specific types of fields need to be specified, mapping can be used to define mappings in index generation.

The settings for the default index in Logstash are template-based, Logstash for indexer roles. First we need to specify a default mapping file, the contents of the file are as follows

(We name it logstash.json, stored in/home/apps/logstash/template/logstash.json):

{  "template": "logstash*",   "settings": {    "index.number_of_shards": 5,     "number" _of_replicas ": 1,    " Index.refresh_interval ":" 60s " },  " mappings ": {   " _default_ ": {       " _all ": {" Enabled ": true},        " dynamic_templates ": [{          "String_fields": {            "Match": "*",     &NBSP ;       "Match_mapping_type": "string",             "mapping": {              "type": "string", "index": "Not_analyzed", "omit_norms": True, "doc_values": true, &N Bsp               "fields": {                &NBSP ;" Raw ": {" type ":" string "," index ":" Not_analyzed "," Ignore_above ":" Doc_values ": true}         & nbsp   &NBsp &NBSP,}            }          }        }], &NB Sp       "Properties": {          "@version": {"type": "string", "index": "Not_analy Zed "},          " GeoIP " : {           " type ":" Object ", &N Bsp
            "dynamic": true,               "path": "Full",               "Properties": {                ' L
Ocation ": {" type ":" Geo_point "}              }          }        }    }  }}

For example, if you have a field that stores content as IP and does not want to be automatically detected as a string type, you can define the type of the IP field in _default_ as IP, as follows:

$ curl-xput localhost:9200/test?pretty-d ' {"mappings": {"_default_": {"Properties": {"IP": {"type": "IP"}}}} '

Where template defines the matching index pattern, and if it is specific to a particular index, it is written directly to the name of the index. The following defines the information about the mapping, which is the same as the contents of the API.

With the above configuration file, you can configure the output plug-in in Logstash:

output {elasticsearch {host = ' localhost ' #ES的服务器地址 protocol => ; "http" #使用的协议, by default may use node, depending on the machine's environment index = "logstash-%{+yyyy. MM.DD} "#匹配的索引模式 document_type =" Test "#索引的类型, the old configuration will use Index_type, but this field has been discarded in the new version, it is recommended to use Document_type MA
        Nage_template = True #注意默认为true, must not be set to false Template_overwrite = True #如果设置为true, when the template name is the same, the new template will overwrite the old template Template_name = "Mylogstash" #注意这个名字是用来查找映射配置的, as far as possible to set as the global unique template "/home/apps/logstash/template/lo" Gstash.json "#映射配置文件的位置}}