Defining field mappings
editDefining field mappings
editYou must define the fields used by your Beat, along with their mapping details,
in _meta/fields.yml
. After editing this file, run make update
.
Define the field mappings in the fields
array:
- key: mybeat title: mybeat description: These are the fields used by mybeat. fields: - name: last_name type: keyword required: true description: > The last name. - name: first_name type: keyword required: true description: > The first name. - name: comment type: text required: false description: > Comment made by the user.
|
|
|
|
|
|
|
Mapping parameters
editYou can specify other mapping parameters for each field. See the Elasticsearch Reference for more details about each parameter.
|
Specify a custom date format used by the field. |
|
For |
|
Whether or not the field is enabled. |
|
Which analyzer to use when indexing. |
|
Which analyzer to use when searching. |
|
Applies to |
|
Dynamic field control. Can be one of |
|
Whether or not the field should be indexed. |
|
Whether or not the field should have doc values generated. |
|
Which field to copy the field value into. |
|
Elasticsearch ignores (does not index) strings that are longer than the
specified value. When this property value is missing or |
For example, you can use the copy_to
mapping parameter to copy the
last_name
and first_name
fields into the full_name
field at index time:
- key: mybeat title: mybeat description: These are the fields used by mybeat. fields: - name: last_name type: text required: true copy_to: full_name description: > The last name. - name: first_name type: text required: true copy_to: full_name description: > The first name. - name: full_name type: text required: false description: > The last_name and first_name combined into one field for easy searchability.
There are also some Kibana-specific properties, not detailed here. These are:
analyzed
, count
, searchable
, aggregatable
, and script
. Kibana
parameters can also be described using pattern
, input_format
,
output_format
, output_precision
, label_template
, url_template
, and
open_link_in_current_tab
.
Defining text multi-fields
editThere are various options that you can apply when using text fields. You can define a simple text field using the default analyzer without any other options, as in the example shown earlier.
To keep the original keyword value when using text
mappings, for instance to
use in aggregations or ordering, you can use a multi-field mapping:
- key: mybeat title: mybeat description: These are the fields used by mybeat. fields: - name: city type: text multi_fields: - name: keyword type: keyword
|
|
|
|
|
For more information, see the Elasticsearch documentation about multi-fields.