We're updating the issue view to help you get more done. 

Stopwords removing wanted terms

Description

Currently there seems to be no special configuration for indices when logstash creates new ones, so the functionality of the stopwords are the ES defaults. In my I'm using a separate/standalone ES instance.

An example where data cannot be visualized: using the geoip filter it creates the field geoip.country_code2 which returns two-letter country codes. An example country code would be "AT" for Austria, but "at" seems to be on the stopworld list. This can be easily tested with the analzer: /_analyzer?text=at returns no tokens for me.

Some kind of solution to tune the stopword behavior from within logstash configuration would be nice.

Environment

None

Status

Assignee

Jordan Sissel

Reporter

Markus Fischer

Priority