now is a scenario where there are 50 fields under field A, and these fields are of the same type as the parser. You don"t want to specify one by one manually. You want to set the template.
but I"m afraid that setting a template will affect all fields, so is there a way to make the template valid only for fields under a certain field?
solved. The template in the index specifies the field with path_match or match, and sets mapping
.Previous: What are the ways to implement this layout?
Next: How to use vue+element to achieve a form form divided into two pages to display it?
the architecture is simple: filebeat collects nginx logs, output to logstash logstash format and then output to elasticsearch There is nothing to say about the configuration of filebeat but to send the access.log of nginx directly to logstash ...
paste the document first: { "total": 5, "online": [ { "sid": "1101006", "total": 0 }, { "sid": "1101001", ...