Lab
A Cloud Guru

Define Mappings in Elasticsearch

Dynamic templates in Elasticsearch make it very easy to index data without having to create explicit mappings for every field. However, sometimes you might prefer to create explicit mappings, or even disable dynamic mapping altogether, in order to have a tighter control over your index structure and datatype requirements. In this learning activity, you are given the opportunity to create explicit field mappings for an index containing log data. Specifically, you will exercise how to: * Create analyzed string fields with a specific analyzer * Create non-analyzed string fields with character limits * Create `geo_point` field mappings * Create numerical field mappings * Create date field mappings * Create IP field mappings * Create nest field mappings (objects) * Reindex data from one index into another with different mappings

Try for free Contact sales

Path Info

Level

Advanced

Duration

2h 0m

Published

Jan 10, 2020

Challenge

Create the index with explicit field mappings.

Use the Kibana console tool to execute the following:

PUT logs_new
{
  "mappings": {
    "properties": {
      "@message": {
        "type": "text"
      },
      "@tags": {
        "type": "keyword",
        "ignore_above": 128
      },
      "@timestamp": {
        "type": "date"
      },
      "@version": {
        "type": "keyword",
        "ignore_above": 256
      },
      "agent": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "bytes": {
        "type": "long"
      },
      "clientip": {
        "type": "ip"
      },
      "extension": {
        "type": "keyword",
        "ignore_above": 256
      },
      "geo": {
        "properties": {
          "coordinates": {
            "type": "geo_point"
          },
          "dest": {
            "type": "keyword",
            "ignore_above": 128
          },
          "src": {
            "type": "keyword",
            "ignore_above": 128
          },
          "srcdest": {
            "type": "keyword",
            "ignore_above": 128
          }
        }
      },
      "headings": {
        "type": "keyword",
        "ignore_above": 256
      },
      "host": {
        "type": "keyword",
        "ignore_above": 256
      },
      "ip": {
        "type": "ip"
      },
      "links": {
        "type": "keyword",
        "ignore_above": 256
      },
      "machine": {
        "properties": {
          "os": {
            "type": "keyword",
            "ignore_above": 256
          },
          "ram": {
            "type": "long"
          }
        }
      },
      "memory": {
        "type": "long"
      },
      "phpmemory": {
        "type": "long"
      },
      "referer": {
        "type": "keyword",
        "ignore_above": 256
      },
      "relatedContent": {
        "properties": {
          "article:modified_time": {
            "type": "date"
          },
          "article:published_time": {
            "type": "date"
          },
          "article:section": {
            "type": "keyword",
            "ignore_above": 128
          },
          "article:tag": {
            "type": "keyword",
            "ignore_above": 128
          },
          "og:description": {
            "type": "text"
          },
          "og:image": {
            "type": "keyword",
            "ignore_above": 256
          },
          "og:image:height": {
            "type": "long"
          },
          "og:image:width": {
            "type": "long"
          },
          "og:site_name": {
            "type": "keyword",
            "ignore_above": 256
          },
          "og:title": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "og:type": {
            "type": "keyword",
            "ignore_above": 128
          },
          "og:url": {
            "type": "text",
            "analyzer": "simple",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "twitter:card": {
            "type": "keyword",
            "ignore_above": 128
          },
          "twitter:description": {
            "type": "text"
          },
          "twitter:image": {
            "type": "keyword",
            "ignore_above": 256
          },
          "twitter:site": {
            "type": "keyword",
            "ignore_above": 128
          },
          "twitter:title": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 128
              }
            }
          },
          "url": {
            "type": "text",
            "analyzer": "simple",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      },
      "request": {
        "type": "text",
        "analyzer": "simple",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "response": {
        "type": "keyword",
        "ignore_above": 128
      },
      "spaces": {
        "type": "text",
        "analyzer": "whitespace"
      },
      "url": {
        "type": "text",
        "analyzer": "simple",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
      "utc_time": {
        "type": "date"
      },
      "xss": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 512
          }
        }
      }
    }
  },
  "settings": {
    "number_of_shards": 4,
    "number_of_replicas": 3
  }
}

Challenge

Reindex the documents from the logs index into the logs_new index.
Use the Kibana console tool to execute the following:
```
POST _reindex
{
  "source": {
    "index": "logs"
  },
  "dest": {
    "index": "logs_new"
  }
}
```

Author

A Cloud Guru

The Cloud Content team comprises subject matter experts hyper focused on services offered by the leading cloud vendors (AWS, GCP, and Azure), as well as cloud-related technologies such as Linux and DevOps. The team is thrilled to share their knowledge to help you build modern tech solutions from the ground up, secure and optimize your environments, and so much more!

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.