从logstash -> output -> elasticsearch动态模板说起

logstash索引映射

"mappings": {
    "_default_": {
        "dynamic_templates": [
            {
                "string_fields": {
                    "mapping": {
                        "index": "analyzed",
                        "omit_norms": true,
                        "type": "string",
                        "fields": { "raw": { "index": "not_analyzed", "ignore_above": 256, "type": "string" } } },
                    "match": "*",
                    "match_mapping_type": "string"
                }
            }
        ],
        "_all": {
            "enabled": true
        },
        "properties": {
            "@version": {
                "type": "string",
                "index": "not_analyzed"
            },
            "geoip": {
                "dynamic": "true",
                "properties": {
                    "location": { "type": "geo_point" } }
            }
        }
    },
    "hkt_log": {
        "dynamic_templates": [
            {
                "string_fields": {
                    "mapping": {
                        "index": "analyzed",
                        "