Hi,
you can simply create your own index mapping and put it into a custom index
template to achieve this. The Graylog index template has the lowest
priority ("order") and any other index template can override its settings.
See https://www.elastic.co/guide/en/elasticsearch/reference/2.3/mapping.html
and
https://www.elastic.co/guide/en/elasticsearch/reference/2.3/indices-templates.html
for details.
Cheers,
Jochen
On Tuesday, 6 September 2016 17:20:17 UTC+2, SancheZZS wrote:
>
> Hello!
> After first run graylog2 I have defaut template in Elasticsearch
> curl -X GET 'http://loclahost:9200/_template?pretty'
> http://pastebin.com/e5LPiGzC
>
> How to change mapping in "dynamic_templates" and "store_generic" from
> "index" : "not_analyzed" to
>
> "analyzer" : "standard",
> "index" : "analyzed",
> "type" : "string"
> ?
>
> I want that any new field, created in web interface, must have "index" :
> "analyzed". By default they have
> "index" : "not_analyzed",
> "type" : "string"
>
> Any advice is greatly appreciated.
>
>
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/a9281451-c4b7-4db1-b972-a339c034b360%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
