Special fields such as _ttl
and _timestamp
have to be defined on the same level as the properties
object:
curl -Xput 'http://elasticsearch:9200/ppe/log/_mapping' -d '{
"log": {
"_ttl": {
"enabled": true
},
"_timestamp": {
"enabled": true,
"store": "yes"
},
"properties": {
"message": {
"type": "string",
"store": "yes"
},
"appid": {
"type": "string",
"store": "yes"
},
"level": {
"type": "integer",
"store": "yes"
},
"logdate": {
"type": "date",
"format": "date_time_no_millis",
"store": "yes"
}
}
}
}
'