-
Notifications
You must be signed in to change notification settings - Fork 307
Update template to use ES 5.x mapping #462
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 9 commits
fc43eb2
3dfad93
9b22019
d1d9208
f912a8c
053473d
2646919
4dfa67e
9ab35eb
b0df891
670503c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,13 +5,13 @@ | |
}, | ||
"mappings" : { | ||
"_default_" : { | ||
"_all" : {"enabled" : true, "omit_norms" : true}, | ||
"_all" : {"enabled" : true, "norms" : false}, | ||
"dynamic_templates" : [ { | ||
"message_field" : { | ||
"match" : "message", | ||
"match_mapping_type" : "string", | ||
"mapping" : { | ||
"type" : "string", "index" : "analyzed", "omit_norms" : true, | ||
"type" : "string", "index" : "analyzed", "norms" : false, | ||
"fielddata" : { "format" : "disabled" } | ||
} | ||
} | ||
|
@@ -20,24 +20,23 @@ | |
"match" : "*", | ||
"match_mapping_type" : "string", | ||
"mapping" : { | ||
"type" : "string", "index" : "analyzed", "omit_norms" : true, | ||
"fielddata" : { "format" : "disabled" }, | ||
"type" : "text", "norms" : false, | ||
"fields" : { | ||
"raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256} | ||
"keyword" : { "type": "keyword" } | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I thought the idea was to let ES run through its defaults in the case that a stringed field is being dynamically mapped There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, but we need There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. See 2 lines above. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. ah, I see. sounds good |
||
} | ||
} | ||
} | ||
} ], | ||
"properties" : { | ||
"@timestamp": { "type": "date" }, | ||
"@version": { "type": "string", "index": "not_analyzed" }, | ||
"@timestamp": { "type": "date", "include_in_all": false }, | ||
"@version": { "type": "keyword", "include_in_all": false }, | ||
"geoip" : { | ||
"dynamic": true, | ||
"properties" : { | ||
"ip": { "type": "ip" }, | ||
"location" : { "type" : "geo_point" }, | ||
"latitude" : { "type" : "float" }, | ||
"longitude" : { "type" : "float" } | ||
"latitude" : { "type" : "half_float" }, | ||
"longitude" : { "type" : "half_float" } | ||
} | ||
} | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,6 @@ | ||
require_relative "../../../spec/es_spec_helper" | ||
|
||
describe "Ingest pipeline execution behavior", :integration => true, :version_5x => true do | ||
describe "Ingest pipeline execution behavior", :integration => true, :version_greater_than_5x => true do | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. good call |
||
subject! do | ||
require "logstash/outputs/elasticsearch" | ||
settings = { | ||
|
@@ -19,7 +19,7 @@ | |
{ | ||
"grok": { | ||
"field": "message", | ||
"pattern": "%{COMBINEDAPACHELOG}" | ||
"patterns": ["%{COMBINEDAPACHELOG}"] | ||
} | ||
} | ||
] | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,93 @@ | ||
require_relative "../../../spec/es_spec_helper" | ||
|
||
# This file is a copy of template test for 2.x. We can DRY this up later. | ||
describe "index template expected behavior for 5.x", :integration => true, :version_greater_than_5x => true do | ||
subject! do | ||
require "logstash/outputs/elasticsearch" | ||
settings = { | ||
"manage_template" => true, | ||
"template_overwrite" => true, | ||
"hosts" => "#{get_host_port()}" | ||
} | ||
next LogStash::Outputs::ElasticSearch.new(settings) | ||
end | ||
|
||
before :each do | ||
# Delete all templates first. | ||
require "elasticsearch" | ||
|
||
# Clean ES of data before we start. | ||
@es = get_client | ||
@es.indices.delete_template(:name => "*") | ||
|
||
# This can fail if there are no indexes, ignore failure. | ||
@es.indices.delete(:index => "*") rescue nil | ||
|
||
subject.register | ||
|
||
subject.multi_receive([ | ||
LogStash::Event.new("message" => "sample message here"), | ||
LogStash::Event.new("somevalue" => 100), | ||
LogStash::Event.new("somevalue" => 10), | ||
LogStash::Event.new("somevalue" => 1), | ||
LogStash::Event.new("country" => "us"), | ||
LogStash::Event.new("country" => "at"), | ||
LogStash::Event.new("geoip" => { "location" => [ 0.0, 0.0 ] }) | ||
]) | ||
|
||
@es.indices.refresh | ||
|
||
# Wait or fail until everything's indexed. | ||
Stud::try(20.times) do | ||
r = @es.search | ||
insist { r["hits"]["total"] } == 7 | ||
end | ||
end | ||
|
||
it "permits phrase searching on string fields" do | ||
results = @es.search(:q => "message:\"sample message\"") | ||
insist { results["hits"]["total"] } == 1 | ||
insist { results["hits"]["hits"][0]["_source"]["message"] } == "sample message here" | ||
end | ||
|
||
it "numbers dynamically map to a numeric type and permit range queries" do | ||
results = @es.search(:q => "somevalue:[5 TO 105]") | ||
insist { results["hits"]["total"] } == 2 | ||
|
||
values = results["hits"]["hits"].collect { |r| r["_source"]["somevalue"] } | ||
insist { values }.include?(10) | ||
insist { values }.include?(100) | ||
reject { values }.include?(1) | ||
end | ||
|
||
it "does not create .keyword field for the message field" do | ||
results = @es.search(:q => "message.keyword:\"sample message here\"") | ||
insist { results["hits"]["total"] } == 0 | ||
end | ||
|
||
it "creates .keyword field from any string field which is not_analyzed" do | ||
results = @es.search(:q => "country.keyword:\"us\"") | ||
insist { results["hits"]["total"] } == 1 | ||
insist { results["hits"]["hits"][0]["_source"]["country"] } == "us" | ||
|
||
# partial or terms should not work. | ||
results = @es.search(:q => "country.keyword:\"u\"") | ||
insist { results["hits"]["total"] } == 0 | ||
end | ||
|
||
it "make [geoip][location] a geo_point" do | ||
expect(@es.indices.get_template(name: "logstash")["logstash"]["mappings"]["_default_"]["properties"]["geoip"]["properties"]["location"]["type"]).to eq("geo_point") | ||
end | ||
|
||
it "aggregate .keyword results correctly " do | ||
results = @es.search(:body => { "aggregations" => { "my_agg" => { "terms" => { "field" => "country.keyword" } } } })["aggregations"]["my_agg"] | ||
terms = results["buckets"].collect { |b| b["key"] } | ||
|
||
insist { terms }.include?("us") | ||
|
||
# 'at' is a stopword, make sure stopwords are not ignored. | ||
insist { terms }.include?("at") | ||
end | ||
end | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this be alpha5 now?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
bump version to
alpha5
?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Will do
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be increased to alpha5 since it has been released.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hahahaha. All of us saw the same thing 👍