In my system, the insertion of data is always done through csv files via logstash. I never pre-define the mapping. But whenever I input a string it is always taken to be analyzed
, as a result an entry like hello I am Sinha
is split into hello
,I
,am
,Sinha
. Is there anyway I could change the default/dynamic mapping of elasticsearch so that all strings, irrespective of index, irrespective of type are taken to be not analyzed
? Or is there a way of setting it in the .conf
file? Say my conf
file looks like
input {
file {
path => "/home/sagnik/work/logstash-1.4.2/bin/promosms_dec15.csv"
type => "promosms_dec15"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
columns => ["Comm_Plan","Queue_Booking","Order_Reference","Multi_Ordertype"]
separator => ","
}
ruby {
code => "event['Generation_Date'] = Date.parse(event['Generation_Date']);"
}
}
output {
elasticsearch {
action => "index"
host => "localhost"
index => "promosms-%{+dd.MM.YYYY}"
workers => 1
}
}
I want all the strings to be not analyzed
and I don't mind it being the default setting for all future data to be inserted into elasticsearch either
You can query the
.raw
version of your field. This was added in Logstash 1.3.1:So if your field is called
foo
, you'd queryfoo.raw
to return thenot_analyzed
(not split on delimiters) version.