Is this by design? Need I create a template with a map to get the main fields aggregatable instead because, my data doesn't have a keyword in the source? Logstash seems to be parsing everything correctly based on the pattern/conf
Wondering if you have any insight for me. If it doesn't work as is plan is to create a template but, I'd like to avoid that if possible because this will be getting data from a lot of different places and if it works using the default that would be great.
Let me know please
NEW: Monitor These Apps!
Apache Lucene, Apache Solr and all other Apache Software Foundation project and their respective logos are trademarks of the Apache Software Foundation.
Elasticsearch, Kibana, Logstash, and Beats are trademarks of Elasticsearch BV, registered in the U.S. and in other countries. This site and Sematext Group is in no way affiliated with Elasticsearch BV.
Service operated by Sematext