Hi,
you can simply create your own index mapping and put it into a custom index
template to achieve this. The Graylog index template has the lowest
priority ("order") and any other index template can override its settings.
See https://www.elastic.co/guide/en/elasticsearch/reference/2.3/mapping.html
and
https://www.elastic.co/guide/en/elasticsearch/reference/2.3/indices-templates.html
for details.
Cheers,
Jochen
On Tuesday, 6 September 2016 17:20:17 UTC+2, SancheZZS wrote:
>
> Hello!
> After first run graylog2 I have defaut template in Elasticsearch
> curl -X GET 'http://loclahost:9200/_template?pretty'
> http://pastebin.com/e5LPiGzC
>
> How to change mapping in "dynamic_templates" and "store_generic" from
> "index" : "not_analyzed" to
>
> "analyzer" : "standard",
> "index" : "analyzed",
> "type" : "string"
> ?
>
> I want that any new field, created in web interface, must have "index" :
> "analyzed". By default they have
> "index" : "not_analyzed",
> "type" : "string"
>
> Any advice is greatly appreciated.
>
>
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/a9281451-c4b7-4db1-b972-a339c034b360%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
