From 4f531511ec2e09f49e7d9342dc05b161a0fcdb62 Mon Sep 17 00:00:00 2001
From: K Jonathan Harker <k.jonathan.harker@hp.com>
Date: Fri, 3 May 2013 22:28:07 +0000
Subject: [PATCH] Add a default_mapping to elasticsearch.

* Don't store or index `_all`.
* Compress `_source` (which is stored but not indexed by default).
* Create a dynamic template for the string type.
* Only analyze the index of `@message` strings.

This is a very rudimentary config, and should probably be expanded
on by someone who has a deeper understanding of elasticsearch.

Change-Id: I14052c48c7bb6f05e259615a5203dc1ad87a08af
Reviewed-on: https://review.openstack.org/28216
Reviewed-by: Clark Boylan <clark.boylan@gmail.com>
Reviewed-by: Jesse Keating <jesse.keating@rackspace.com>
Approved: Monty Taylor <mordred@inaugust.com>
Reviewed-by: Monty Taylor <mordred@inaugust.com>
Tested-by: Jenkins
---
 files/elasticsearch.mapping.json | 19 +++++++++++++++++++
 manifests/init.pp                | 11 +++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 files/elasticsearch.mapping.json

diff --git a/files/elasticsearch.mapping.json b/files/elasticsearch.mapping.json
new file mode 100644
index 0000000..a469881
--- /dev/null
+++ b/files/elasticsearch.mapping.json
@@ -0,0 +1,19 @@
+{
+  "_default_": {
+    "_all": { "enabled": false },
+    "_source": { "compress": true },
+    "dynamic_templates": [
+      {
+        "string_template" : {
+          "match" : "*",
+          "mapping": { "type": "string", "index": "not_analyzed" },
+          "match_mapping_type" : "string"
+        }
+      }
+    ]
+    "properties" : {
+      "@fields": { "type": "object", "dynamic": true, "path": "full" },
+      "@message" : { "type" : "string", "index" : "analyzed" }
+    }
+  }
+}
diff --git a/manifests/init.pp b/manifests/init.pp
index dd5b28e..dbd4914 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -47,6 +47,16 @@ class logstash::elasticsearch {
     require => Package['elasticsearch'],
   }
 
+  file { '/etc/elasticsearch/default_mapping.json':
+    ensure  => present,
+    source  => 'puppet:///modules/logstash/elasticsearch.mapping.json',
+    replace => true,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    require => Package['elasticsearch'],
+  }
+
   file { '/etc/default/elasticsearch':
     ensure  => present,
     source  => 'puppet:///modules/logstash/elasticsearch.default',
@@ -62,6 +72,7 @@ class logstash::elasticsearch {
     require   => Package['elasticsearch'],
     subscribe => [
       File['/etc/elasticsearch/elasticsearch.yml'],
+      File['/etc/elasticsearch/default_mapping.json'],
       File['/etc/default/elasticsearch'],
     ],
   }