[ML] Add keyword mapping to audit message to enable aggs (elastic/x-pack-elasticsearch#583)
The messages stored in the .ml-notifications index include a message field that is mapped to text. It makes sense to keep that mapping as it can improve search experience in messages. However, the ML kibana app needs to aggregate over messages, thus we also need to provide a keyword mapping. Original commit: elastic/x-pack-elasticsearch@5a5df53d85
This commit is contained in:
parent
6edc051e8d
commit
1ae8ed495e
|
@ -63,6 +63,7 @@ public class ElasticsearchMappings {
|
||||||
static final String PROPERTIES = "properties";
|
static final String PROPERTIES = "properties";
|
||||||
static final String TYPE = "type";
|
static final String TYPE = "type";
|
||||||
static final String DYNAMIC = "dynamic";
|
static final String DYNAMIC = "dynamic";
|
||||||
|
static final String FIELDS = "fields";
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Name of the custom 'all' field for results
|
* Name of the custom 'all' field for results
|
||||||
|
@ -85,6 +86,8 @@ public class ElasticsearchMappings {
|
||||||
static final String LONG = "long";
|
static final String LONG = "long";
|
||||||
static final String TEXT = "text";
|
static final String TEXT = "text";
|
||||||
|
|
||||||
|
static final String RAW = "raw";
|
||||||
|
|
||||||
private ElasticsearchMappings() {
|
private ElasticsearchMappings() {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -657,6 +660,11 @@ public class ElasticsearchMappings {
|
||||||
.endObject()
|
.endObject()
|
||||||
.startObject(AuditMessage.MESSAGE.getPreferredName())
|
.startObject(AuditMessage.MESSAGE.getPreferredName())
|
||||||
.field(TYPE, TEXT)
|
.field(TYPE, TEXT)
|
||||||
|
.startObject(FIELDS)
|
||||||
|
.startObject(RAW)
|
||||||
|
.field(TYPE, KEYWORD)
|
||||||
|
.endObject()
|
||||||
|
.endObject()
|
||||||
.endObject()
|
.endObject()
|
||||||
.startObject(AuditMessage.TIMESTAMP.getPreferredName())
|
.startObject(AuditMessage.TIMESTAMP.getPreferredName())
|
||||||
.field(TYPE, DATE)
|
.field(TYPE, DATE)
|
||||||
|
|
Loading…
Reference in New Issue