{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/275","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/275/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/275/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/275/events","html_url":"https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/275","id":112595129,"number":275,"title":"Improve default template","user":{"login":"sathieu","id":741106,"avatar_url":"https://avatars.githubusercontent.com/u/741106?v=3","gravatar_id":"","url":"https://api.github.com/users/sathieu","html_url":"https://github.com/sathieu","followers_url":"https://api.github.com/users/sathieu/followers","following_url":"https://api.github.com/users/sathieu/following{/other_user}","gists_url":"https://api.github.com/users/sathieu/gists{/gist_id}","starred_url":"https://api.github.com/users/sathieu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sathieu/subscriptions","organizations_url":"https://api.github.com/users/sathieu/orgs","repos_url":"https://api.github.com/users/sathieu/repos","events_url":"https://api.github.com/users/sathieu/events{/privacy}","received_events_url":"https://api.github.com/users/sathieu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-21T13:59:52Z","updated_at":"2015-10-21T15:55:13Z","closed_at":null,"body":"I suggest the following:\r\n* Use \"index\": \"not_analyzed\" on all string fields (except message?)\r\n* Use \"doc_values\": true on all string fields"},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/comments/149941476","html_url":"https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/275#issuecomment-149941476","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/275","id":149941476,"user":{"login":"untergeek","id":1020383,"avatar_url":"https://avatars.githubusercontent.com/u/1020383?v=3","gravatar_id":"","url":"https://api.github.com/users/untergeek","html_url":"https://github.com/untergeek","followers_url":"https://api.github.com/users/untergeek/followers","following_url":"https://api.github.com/users/untergeek/following{/other_user}","gists_url":"https://api.github.com/users/untergeek/gists{/gist_id}","starred_url":"https://api.github.com/users/untergeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untergeek/subscriptions","organizations_url":"https://api.github.com/users/untergeek/orgs","repos_url":"https://api.github.com/users/untergeek/repos","events_url":"https://api.github.com/users/untergeek/events{/privacy}","received_events_url":"https://api.github.com/users/untergeek/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T15:55:13Z","updated_at":"2015-10-21T15:55:13Z","body":"> - Use \"index\": \"not_analyzed\" on all string fields (except message?)\r\n\r\n- This is already [addressed](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json#L24) by making all strings have a .raw, not_analyzed variant.\r\n- And the message field is [already mapped](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json#L10-L17) to still be analyzed.\r\n\r\n> - Use \"doc_values\": true on all string fields\r\n\r\n2 things:\r\n\r\n1. doc_values can only be used on not_analyzed strings\r\n2. doc_values will automatically be applied to not_analyzed strings by default in Elasticsearch 2.0\r\n\r\nAs such, the current template should already address your concerns for future releases of Logstash and Elasticsearch."}}