Configuring default index mappings in Logstash

Index fields are indexed using automatic detection in ES, such as IP, date auto-detect (default on), Auto-detect (default off) for dynamic mapping to automatically index documents, and when specific types of fields need to be specified, you might use mapping to define mappings in index generation.

The settings for the default index in Logstash are template-based.

First we need to specify a default mapping file, the contents of the file are as follows:

{  "Template":"logstash-*",  "Mappings" : {    "_default_" : {       "Properties" : {             "IP" :{                  "type":"IP"             }          }       }    }}    

Where template defines the matching index pattern, and if it is specific to a particular index, it is written directly to the name of the index. The following defines the information about the mapping, which is the same as the contents of the API.

With the above configuration file, you can configure the output plug-in in Logstash:

Output {elasticsearch {host="localhost"#ES的服务器地址 Protocol="http"#使用的协议, node may be used by default, depending on the environment of the machine index="logstash-%{+yyyy. MM.DD}"#匹配的索引模式 Document_type="Test"#索引的类型, the old configuration uses Index_type, but this field has been deprecated in the new version, and Document_type is recommended Manage_template=true#注意默认为true, must not be set to False Template_overwrite=true#如果设置为true, when the template name is the same, the new template will overwrite the old template template_name="Mylogstash"#注意这个名字是用来查找映射配置的, try to set it as a globally unique template="/home/apps/test/logstash.conf"#映射配置文件的位置}}

Configure default index mappings in Logstash