Stopwords removing wanted terms

Description

Currently there seems to be no special configuration for indices when logstash creates new ones, so the functionality of the stopwords are the ES defaults. In my I'm using a separate/standalone ES instance.

An example where data cannot be visualized: using the geoip filter it creates the field geoip.country_code2 which returns two-letter country codes. An example country code would be "AT" for Austria, but "at" seems to be on the stopworld list. This can be easily tested with the analzer: /_analyzer?text=at returns no tokens for me.

Some kind of solution to tune the stopword behavior from within logstash configuration would be nice.

Status

Assignee

Jordan Sissel

Reporter

Markus Fischer
Configure