How to create raw fields for custom logstash indexes?

Question

elasticsearch

Good afternoon.
At first, I used the default logstash-* index, in which, in addition to the main fields, raw fields were also created.
Decided to put a part of the data in a separate index. I read the docks and seemed to set everything up as it should, as a result, in the elastic I have a breakdown into the fields I need, but there are no raw fields that are convenient to use for dashboards.
My output config

output {
if [Alert_Analyzer_Name] == "ossec" {
elasticsearch {
hosts => "127.0.0.1:9200"
index => "logstash-%{+YYYY.MM.dd}"
template_overwrite => "true"
}
}
if [ type] == "weblog" {
elasticsearch {
hosts => "127.0.0.1:9200"
index => "weblog-%{+YYYY.MM.dd}"
template_overwrite => "true"
}
}
}

curl -XGET localhost:9200/_template/logstash*
{"logstash":{"order":0,"template":"weblog-*","settings":{"index":{"refresh_interval":"5s" }},"mappings":{"_default_":{"dynamic_templates":[{"message_field":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string" },"match_mapping_type":"string","match":"message"}},{"string_fields":{"mapping":{"index":"analyzed","omit_norms":true,"type":" string","fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic" :true,"type":"object","properties":{"location":{"type":"geo_point"}}},"@version":{"index":"not_analyzed","type": "string"}}}},"aliases":{}}}}index":"not_analyzed","type":"string"}}}},"aliases":{}}}}index":"not_analyzed","type":"string"}}}},"aliases":{}}}}

curl -XGET localhost:9200/_template/weblog*
{"weblog-*":{"order":0,"template":"logstash-*","settings":{"index":{"refresh_interval":"5s"}},"mappings":{" _default_":{"dynamic_templates":[{"message_field":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string"},"match_mapping_type":"string" ,"match":"message"}},{"string_fields":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields":{" raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object ","properties":{"location":{"type":"geo_point"}}},"@version":{"index":"not_analyzed","type":"string"}}}}," aliases":{}},"weblog":{"order":0,"template":"logstash-*","settings":{"index":{"refresh_interval":"5s"}},"mappings ":{"_default_":{"dynamic_templates":[{"message_field":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string"},"match_mapping_type" :"string","match":"message"}},{"string_fields":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields": {"raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*"}}], "_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties":{"location" :{"type":"geo_point"}}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}:"message"}},{"string_fields":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{ "ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{" omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties":{"location":{"type": "geo_point"}}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}:"message"}},{"string_fields":{"mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{ "ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{" omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties":{"location":{"type": "geo_point"}}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{"ignore_above":256,"index":"not_analyzed", "type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{"omit_norms":true,"enabled":true},"properties ":{"geoip":{"dynamic":true,"type":"object","properties":{"location":{"type":"geo_point"}}},"@version":{" index":"not_analyzed","type":"string"}}}},"aliases":{}}}}mapping":{"index":"analyzed","omit_norms":true,"type":"string","fields":{"raw":{"ignore_above":256,"index":"not_analyzed", "type":"string"}}},"match_mapping_type":"string","match":"*"}}],"_all":{"omit_norms":true,"enabled":true},"properties ":{"geoip":{"dynamic":true,"type":"object","properties":{"location":{"type":"geo_point"}}},"@version":{" index":"not_analyzed","type":"string"}}}},"aliases":{}}}}"fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*" }}],"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties": {"location":{"type":"geo_point"}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}} }"fields":{"raw":{"ignore_above":256,"index":"not_analyzed","type":"string"}}},"match_mapping_type":"string","match":"*" }}],"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties": {"location":{"type":"geo_point"}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}} }"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties":{"location" :{"type":"geo_point"}}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}"_all":{"omit_norms":true,"enabled":true},"properties":{"geoip":{"dynamic":true,"type":"object","properties":{"location" :{"type":"geo_point"}}}},"@version":{"index":"not_analyzed","type":"string"}}}},"aliases":{}}}

At the same time, fields are present in the logstash-* raw indexes, but they are not in the weblog-* index.
I use logstash 2.3 and elastic 2.3.
I tried a bunch of recipes, but nothing helped, maybe I don’t understand something.

Answer 1

We take settings and mapping from the old index.
GET logstash-my-old-index/_settings
GET logstash-my-old-index/_mapping
After that, in the mapping, look for the definition of "fields": {"raw": "not_analyzed"}
Should be something like this

....
"myfield" : {
   "type": "string",
   .....
   "fields": {
      "raw": { "type" :"string", "index": "not_analyzed"}
    }
}
....

Example: https://www.elastic.co/guide/en/elasticsearch/guid...
Description: https://www.elastic.co/guide/en/elasticsearch/ref...