9ff9e35c12
Right now Rsyslog->ES will log like: logstash-YYYY.MM.DD.HH This creates a ton of indexes making search much harder. This commit removes the .HH so we have: logstash-YYYY.MM.DD This also patches the template to work with ES5 Change-Id: Iaef70f51601da504b769165e8593603adc484225
60 lines
1.7 KiB
JSON
60 lines
1.7 KiB
JSON
{
|
|
"template": "logstash-*",
|
|
"settings": {
|
|
"index": {
|
|
"number_of_shards": "5",
|
|
"number_of_replicas": "0",
|
|
"mapping": {
|
|
"total_fields": {
|
|
"limit": "5000"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mappings": {
|
|
"result": {
|
|
"properties": {
|
|
"CEE": {
|
|
"properties": {
|
|
"failed": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
},
|
|
"suspended": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"action": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
},
|
|
"browbeat_cloud_name": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
},
|
|
"message": {
|
|
"properties": {
|
|
"openstack-general-system-performance": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"level": {
|
|
"type": "string"
|
|
},
|
|
"hostname": {
|
|
"index": "not_analyzed",
|
|
"type": "string"
|
|
},
|
|
"timestamp": {
|
|
"type": "date",
|
|
"format": "strict_date_optional_time||epoch_millis"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|