Add a default_mapping to elasticsearch.

* Don't store or index `_all`.
* Compress `_source` (which is stored but not indexed by default).
* Create a dynamic template for the string type.
* Only analyze the index of `@message` strings.

This is a very rudimentary config, and should probably be expanded
on by someone who has a deeper understanding of elasticsearch.

Change-Id: I14052c48c7bb6f05e259615a5203dc1ad87a08af
Reviewed-on: https://review.openstack.org/28216
Reviewed-by: Clark Boylan <clark.boylan@gmail.com>
Reviewed-by: Jesse Keating <jesse.keating@rackspace.com>
Approved: Monty Taylor <mordred@inaugust.com>
Reviewed-by: Monty Taylor <mordred@inaugust.com>
Tested-by: Jenkins

modules/logstash/files/elasticsearch.mapping.json

@@ -0,0 +1,19 @@
+{
+  "_default_": {
+    "_all": { "enabled": false },
+    "_source": { "compress": true },
+    "dynamic_templates": [
+      {
+        "string_template" : {
+          "match" : "*",
+          "mapping": { "type": "string", "index": "not_analyzed" },
+          "match_mapping_type" : "string"
+        }
+      }
+    ]
+    "properties" : {
+      "@fields": { "type": "object", "dynamic": true, "path": "full" },
+      "@message" : { "type" : "string", "index" : "analyzed" }
+    }
+  }
+}

modules/logstash/manifests/elasticsearch.pp

@@ -47,6 +47,16 @@ class logstash::elasticsearch {
     require => Package['elasticsearch'],
   }
 
+  file { '/etc/elasticsearch/default_mapping.json':
+    ensure  => present,
+    source  => 'puppet:///modules/logstash/elasticsearch.mapping.json',
+    replace => true,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    require => Package['elasticsearch'],
+  }
+
   file { '/etc/default/elasticsearch':
     ensure  => present,
     source  => 'puppet:///modules/logstash/elasticsearch.default',
@@ -62,6 +72,7 @@ class logstash::elasticsearch {
     require   => Package['elasticsearch'],
     subscribe => [
       File['/etc/elasticsearch/elasticsearch.yml'],
+      File['/etc/elasticsearch/default_mapping.json'],
       File['/etc/default/elasticsearch'],
     ],
   }