csv - Logstash not_analyzed -
i total newby elk stack , trying setup complicated config start with... :-)
i running whole stack on windows 7 laptop. , importing csv goes cannot string field not analysed giving me broken text in kibana visualisations.
last try template.
both template , conf file located in c:\logstash-1.5.0\bin directory.
this conf file:
input { file { path => "c:\users\jeroen\documents\temp\csv\elasticsearch_input_vc.csv" type => "core2" start_position => "beginning" } } filter { csv { columns => ["snapshot_date_time","country","tower","service","division","usd group","ref nr","processtype","importance","priority","severity","status , reason","category","is_valid_category","summary","open date time","closed date time","opened by","last modified","resolve completed date time","hrs_assigned_to_completed","first assign date time","hrs_new_to_assign","customer organization","requested by","assignee","active flag","in out sla resolution 1"] separator => ";" } date { match => [ "snapshot_date_time", "yyyy-mm-dd hh:mm:ss" ] } mutate { convert => { "hrs_assigned_to_completed" => "float" } convert => { "hrs_new_to_assign" => "float" } } } output { elasticsearch { action => "index" host => "localhost" index => "qdb-%{+yyyy.mm.dd}" workers => 1 template => "template.json" } #stdout { #codec => rubydebug #} }
and template (which copied topic , changed "template name") , in doubt 7th line specific data used originator...
#template.json: { "template": "qdb-%{+yyyy.mm.dd}", "settings" : { "number_of_shards" : 1, "number_of_replicas" : 0, "index" : {"query" : { "default_field" : "userid" } } }, "mappings": { "_default_": { "_all": { "enabled": false }, "_source": { "compress": true }, "dynamic_templates": [ { "string_template" : { "match" : "*", "mapping": { "type": "string", "index": "not_analyzed" }, "match_mapping_type" : "string" } } ], "properties" : { "date" : { "type" : "date", "format": "yyyy-mm-dd hh:mm:ss"}, "device" : { "type" : "string", "fields": {"raw": {"type": "string","index": "not_analyzed"}}}, "distance" : { "type" : "integer"} } } }
any help/hints/tips appreciated!
what need mapping in first elasticsearch after import data via logstash , see data in kibana wich data not analyzed
http://host:9200/yourindex/_mapping/yourtype { "your type": { "properties": { "user" : { "type" : "string", "index": "not_analyzed", "data" : { "type" : "string", "index": "not_analyzed" } }
Comments
Post a Comment