curl -XPUT http://192.168.91.221:9200/_template/template_ssh_log -d '
{
"order": 0,
"template": "ssh_log-",
"settings": {
"index": {
"refresh_interval": "5s"
}
},
"mappings": {
"default": {
"dynamic_templates": [
{
"string_fields": {
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string",
"fields": {
"raw": {
"ignore_above": 256,
"index": "not_analyzed",
"type": "string",
"doc_values": true
}
}
},
"match_mapping_type": "string",
"match": ""
}
}
],
"_all": {
"enabled": true
},
"properties": {
"@timestamp": {
"format": "dateOptionalTime",
"index": "not_analyzed",
"type": "date",
"doc_values": true
},
"geoip": {
"dynamic": true,
"type": "object",
"properties": {
"location": {
"type": "geo_point"
}
}
},
"@version": {
"index": "not_analyzed",
"type": "string"
}
}
}
},
"aliases": {}
}'

注:"type": "date", "index": "not_analyzed" #索引不分詞

在logash配置文件里就可以創(chuàng)建syslog-開頭的索引。Elsticsearch會(huì)自動(dòng)匹配syslog-*索引模板。
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.91.221:9200", "192.168.91.222:9200", "192.168.91.223:9200"]
#hosts => ["192.168.91.221:9200"]
index => "syslog-%{+YYYY.MM.dd}"
}
}