Hi Dilip, the index mapping of Graylog is applied by the means of an index template. In Graylog 2.0.0, the index template will automatically be updated but in older versions you'll have to remove the index template yourself for it to be recreated by Graylog.
See https://www.elastic.co/guide/en/elasticsearch/reference/1.7/indices-templates.html for details. Cheers, Jochen On Thursday, 28 April 2016 21:42:23 UTC+2, Dilip Muthukrishnan wrote: > > I'm trying to change the analyzer from "standard" to "whitespace". I've > set the following property in my Graylog server configuration: > > elasticsearch_analyzer = whitespace > > It states that my change will be applied to new indices so I manually > cycled the deflector so that it is now pointing to graylog2_1 (previously > graylog2_0). However, the new index still uses the "standard" analyzer > based on the mapping in Elasticsearch: > > "message" : { > "type" : "string", > "analyzer" : "standard" > }, > > > How do I change the analyzer? > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/cb78dcd5-9926-43c4-8eb2-da9a3bafb69c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
