Term breaks my field value into multiple values.

[rightedges]

My field value looks like "UzC1qjJMt_afb-gjOewA:9". Term breaks it into three different values "UzC1qjJMt_afb", "gjOewA" and "9". It looks pretty consistent for all the field values. It sounds like an issue with term. Can somebody confirm it? Thanks.

[dadoonet]

I think it's more a question on analyzer.
If you have default analyzer for this field, then doing facet on it will show strange results.

You should modify your mapping. See http://www.elasticsearch.org/guide/reference/mapping/

[rightedges]

Ah I'll look into that. Thanks!

[KlavsKlavsen]

how should one change the mapping?

[KlavsKlavsen]

or rather - is there a default recommendation for logstash users?

[ruckc]

Elasticsearch allows you to setup a default-mapping.json file in the
CONF_DIR. Below is the file I use for logstash version 1 and elasticsearch
0.90.x.

{
"default": {
"_all": { "enabled": false },
"_source": { "compress": true },
"properties" : {
"message" : { "type" : "string", "index" : "analyzed" },
"source_host" : { "type" : "string", "index" : "not_analyzed" },
"tags": { "type": "string", "index" : "not_analyzed" },
"@timestamp" : { "type" : "date", "index" : "not_analyzed" },
"type" : { "type" : "string", "index" : "not_analyzed" }
}
}
}

Curtis Ruck
Anytime: 210-857-1126

On Mon, Nov 4, 2013 at 6:28 AM, Klavs Klavsen notifications@github.comwrote:

or rather - is there a default recommendation for logstash users?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/364#issuecomment-27678861
.

[KlavsKlavsen]

@ruckc Thank you very much.
one note. AFAIK source_host is actually just called host in v1 (logstash 1.2+).. so should it say host instead?

[KlavsKlavsen]

so - if I set my host to type string - then it will stop trying to split hostnames such as "server-pre01" into two?

[ruckc]

No, the special juju is the 'not_analyzed'. Also, i use a custom pure-java
logstash replacement so i never fully switched to v1.

Curtis Ruck
Anytime: 210-857-1126

On Mon, Nov 4, 2013 at 9:23 AM, Klavs Klavsen notifications@github.comwrote:

so - if I set my host to type string - then it will stop trying to split
hostnames such as "server-pre01" into two?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/364#issuecomment-27687984
.

[pobzeb-relevantidea]

Not sure if this is still an issue but you can use "{field_name}.raw" now to get the non-analyzed version of the value. For example, if your field name is "host" you can use "host.raw".

[rashidkpc]

You can only use .raw if it is in your mapping. If you're a logstash user it usually will be.