Set for each type the property not_analyzed for the custom object
You have several options that will work. Personally, I would go with one of the first two. If it's a daily index, the second option is the best option.
-
Define upfront mapping and disable dynamic fields. This is by far the safest approach and it will help you avoid mistakes and it will prevent you from adding fields afterwards.
{ "mappings": { "_default_": { "_all": { "enabled": false } }, "mytype" : { "dynamic" : "strict", "properties" : { ... } } } }
-
Create an index template that also disables dynamic fields, but allows you to continuously scan new indexes with the same mappings.
You can create multi-level index templates so that more than one is applicable to any given index.
{ "template": "mytimedindex-*", "settings": { "number_of_shards": 2 }, "mappings": { "_default_": { "_all": { "enabled": false } }, "mytype" : { "dynamic" : "strict", "properties" : { ... } } } }
-
Create a dynamic mapping that allows you to create new fields, but by default everything
string
isnot_analyzed
:"dynamic_templates" : [ { "strings" : { "mapping" : { "index" : "not_analyzed", "type" : "string" }, "match" : "*", "match_mapping_type" : "string" } } ]
This will allow you to dynamically add fields to the display.
source to share