Stopwords removing wanted terms


Currently there seems to be no special configuration for indices when logstash creates new ones, so the functionality of the stopwords are the ES defaults. In my I'm using a separate/standalone ES instance.

An example where data cannot be visualized: using the geoip filter it creates the field geoip.country_code2 which returns two-letter country codes. An example country code would be "AT" for Austria, but "at" seems to be on the stopworld list. This can be easily tested with the analzer: /_analyzer?text=at returns no tokens for me.

Some kind of solution to tune the stopword behavior from within logstash configuration would be nice.



Jordan Sissel


Markus Fischer