Replacing a dot in an field name

问题:

Good morning,

Working on upgrading to the lastest version of the ELK stack and running into an issue with the field mapping. I have something similar to the following in my raw data:

{
  "_index" : "logstash-2016.04.21",
  "level1" : {
    "level2" : {
      "1" : "somevalue",
      "1.1" : "somevalue1"
    }
  }
}

And as we all know elasticsearch 2.X does not like dots (.) in field names, messes up the dot-notation. So as a total newbie to elasticsearch, I have not been able to find a way, or search the right terms, to find a way to fix this using mappings or analyzers or 'something i do not yet know about'. I am hoping the community here can help me find a way to fix this so I can re-index all of my current indexes as well as mapping it for future indexes.

Currently on ES version 1.7, running on debian

Thank you, Mike

回答1:

If you can't fix the input, logstash has a de_dot filter for this purpose.