采集nginx日志的时候发现从filebeat采集的json日志到elasticsearch里面都是keyword类型，导致我模糊查询部分字段的时候无法模糊匹配，所以需要将某些字段改成text类型。
filebeat.inputs: - type: log enabled: true json.keys_under_root: true json.overwrite_keys: true paths: - "/x/*.log" tags: ["php-nginx-access"] output.elasticsearch: hosts: ["10.8.44.5:9200"] username: "xxx" password: "xxx" indices: - index: "php-nginx-access-%{[agent.version]}-%{+yyyy.MM}" when.contains: tags: "php-nginx-access" setup.template.name: "php-nginx-access" setup.template.pattern: "php-nginx-access-*" setup.template.fields: "myfields.yml" setup.template.overwrite: true setup.template.enabled: true setup.ilm.enabled: false
关键的地方就是修改了fields.yml。
- key: php-nginx-access title: php description: > php access log fields: - name: request type: text ignore_above: 1024 - name: ‘@timestamp‘ level: core required: true type: date description: ‘Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.‘ example: ‘2016-05-23T08:05:34.853Z‘
原文：https://www.cnblogs.com/bill2014/p/14589426.html