{
"default@template": {
"order": 1, // Priority of the template. The greater the value, the higher the priority
"index_patterns": [ // Index to which the template is applied
"*"
],
"settings": {
"index": {
"max_result_window": "65536", // Maximum query result window. If the result quantity exceeds this value, error message "Result window is too large" will be displayed, and you will need to increase this value
"routing": {
"allocation": {
"include": {
"temperature": "hot"
}
}
},
"refresh_interval": "30s", // Index refresh interval. The indexed document can only be queried after the interval elapses. If you have high requirement for real-time query, you can properly reduce this value, but a too small value will compromise the write performance
"unassigned": {
"node_left": {
"delayed_timeout": "5m"
}
},
"translog": {
"sync_interval": "5s", // translog flush interval. A too small value will compromise the write performance
"durability": "async"
},
"number_of_replicas": "1" // Number of replica shards
}
},
"mappings": {
"_default_": {
"_all": {
"enabled": false // It is recommended to set this parameter to disabled. The `_all` field contains all other fields to form a large string, which will take up a lot of disk space and compromise the write performance
},
"dynamic_templates": [ // Dynamic template
{
"message_full": { // Dynamically map the field named `message_full` to `text` and `keyword` types
"match": "message_full",
"mapping": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 2048
}
}
}
}
},
{
"message": { // Dynamically map the field named `message` to `text` type
"match": "message",
"mapping": {
"type": "text"
}
}
},
{
"strings": { // Dynamically map a field of `string` type to `keyword` type
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
}
]
}
},
"aliases": {}
}
}
Was this page helpful?