The problems was this line...
*"index.query.default_field" : "@message"*
Why?
Thanks.
On Sunday, March 30, 2014 6:20:34 PM UTC+2, Israel Calvete wrote:
>
> Ok
>
> I have a template...
>
> *{*
> * "template" : "logstash*",*
> * "settings" : {*
> * "index.store.compress.stored" : "true",*
> * "index.cache.field.type" : "soft",*
> * "index.query.default_field" : "@message",*
> * },*
> * "mappings" : {*
> * "_default_" : {*
> * "_all" : {"enabled" : false},*
> * "_source": { "compress": true },*
> * "properties" : {*
> * "@fields" : {*
> * "type" : "object",*
> * "dynamic": true,*
> * "path": "full",*
> * "properties" : {*
> * "errnum" : { "type":
> "integer"}*
> * }*
> * },*
> * "@message": { "type": "string", "index":
> "analyzed" },*
> * "@source": { "type": "string", "index":
> "not_analyzed" },*
> * "@source_host": { "type": "string",
> "index": "not_analyzed" },*
> * "@source_path": { "type": "string",
> "index": "not_analyzed" },*
> * "@tags": { "type": "string", "index":
> "not_analyzed" },*
> * "@timestamp": { "type": "date", "index":
> "not_analyzed" },*
> * "@type": { "type": "string", "index":
> "not_analyzed" }*
> * }*
> * }*
> * }*
> *}*
>
> Without template works, but I don't know why.
>
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/111a08d7-c588-48c4-bccc-4b29263a0e1c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
