From 7af16378d331472c90996e7576363f345f4ae6b2 Mon Sep 17 00:00:00 2001 From: Jordan Powers Date: Fri, 7 Nov 2025 11:16:00 -0800 Subject: [PATCH 1/3] Add applies_to label to logsdb message default sort setting --- .../mapping-reference/pattern-text.md | 30 +++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/reference/elasticsearch/mapping-reference/pattern-text.md b/docs/reference/elasticsearch/mapping-reference/pattern-text.md index 52a7727b4f0d5..42ded128adbc3 100644 --- a/docs/reference/elasticsearch/mapping-reference/pattern-text.md +++ b/docs/reference/elasticsearch/mapping-reference/pattern-text.md @@ -46,8 +46,8 @@ In both cases, all queries return a constant score of 1.0. ## Index sorting for improved compression The compression provided by `pattern_text` can be significantly improved if the index is sorted by the `template_id` field. -This sorting is not applied by default, but can be enabled for the `message` field of LogsDB indices (assuming it is of type `pattern_text`) by setting the index setting `index.logsdb.default_sort_on_message_template` to `true`. -This will cause the index to be sorted by `host.name` (if present), then `message.template_id`, and finally by `@timestamp`. + +### Custom sorting If the index is not LogsDB or the `pattern_text` field is named something other than `message`, index sorting can still be manually applied as shown in the following example. ```console @@ -72,6 +72,32 @@ PUT logs } ``` +### Default sorting for LogsDB {applies_to}`stack: preview 9.3` +This sorting is not applied by default, but can be enabled for the `message` field of LogsDB indices (assuming it is of type `pattern_text`) by setting the index setting `index.logsdb.default_sort_on_message_template` to `true`. +This will cause the index to be sorted by `host.name` (if present), then `message.template_id`, and finally by `@timestamp`. + +```console +PUT logs +{ + "settings": { + "index": { + "mode": "logsdb", + "logsdb.default_sort_on_message_template": true + } + }, + "mappings": { + "properties": { + "@timestamp": { + "type": "date" + }, + "message": { + "type": "pattern_text" + } + } + } +} +``` + ## Parameters for pattern text fields [pattern-text-params] From 2a0768fce14fb58fb81de419155e1076b4c5764a Mon Sep 17 00:00:00 2001 From: Jordan Powers Date: Fri, 7 Nov 2025 11:21:11 -0800 Subject: [PATCH 2/3] Fix docs applies_to tag format --- .../elasticsearch/mapping-reference/pattern-text.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/reference/elasticsearch/mapping-reference/pattern-text.md b/docs/reference/elasticsearch/mapping-reference/pattern-text.md index 42ded128adbc3..0402cf5d78770 100644 --- a/docs/reference/elasticsearch/mapping-reference/pattern-text.md +++ b/docs/reference/elasticsearch/mapping-reference/pattern-text.md @@ -72,7 +72,11 @@ PUT logs } ``` -### Default sorting for LogsDB {applies_to}`stack: preview 9.3` +### Default sorting for LogsDB +```{applies_to} +serverless: preview +stack: preview 9.3 +``` This sorting is not applied by default, but can be enabled for the `message` field of LogsDB indices (assuming it is of type `pattern_text`) by setting the index setting `index.logsdb.default_sort_on_message_template` to `true`. This will cause the index to be sorted by `host.name` (if present), then `message.template_id`, and finally by `@timestamp`. From d97bd636c42acc7ed9663d5b2be9a5ade9de7d8e Mon Sep 17 00:00:00 2001 From: Jordan Powers Date: Fri, 7 Nov 2025 11:28:09 -0800 Subject: [PATCH 3/3] Tweak docs --- .../mapping-reference/pattern-text.md | 37 +++++-------------- 1 file changed, 9 insertions(+), 28 deletions(-) diff --git a/docs/reference/elasticsearch/mapping-reference/pattern-text.md b/docs/reference/elasticsearch/mapping-reference/pattern-text.md index 0402cf5d78770..bd82f05171d99 100644 --- a/docs/reference/elasticsearch/mapping-reference/pattern-text.md +++ b/docs/reference/elasticsearch/mapping-reference/pattern-text.md @@ -47,46 +47,26 @@ In both cases, all queries return a constant score of 1.0. ## Index sorting for improved compression The compression provided by `pattern_text` can be significantly improved if the index is sorted by the `template_id` field. -### Custom sorting -If the index is not LogsDB or the `pattern_text` field is named something other than `message`, index sorting can still be manually applied as shown in the following example. - -```console -PUT logs -{ - "settings": { - "index": { - "sort.field": [ "notice.template_id", "@timestamp" ], - "sort.order": [ "asc", "desc" ] - } - }, - "mappings": { - "properties": { - "@timestamp": { - "type": "date" - }, - "notice": { - "type": "pattern_text" - } - } - } -} -``` ### Default sorting for LogsDB ```{applies_to} serverless: preview stack: preview 9.3 ``` -This sorting is not applied by default, but can be enabled for the `message` field of LogsDB indices (assuming it is of type `pattern_text`) by setting the index setting `index.logsdb.default_sort_on_message_template` to `true`. +This index sorting is not applied by default, but can be enabled for the `message` field of LogsDB indices (assuming it is of type `pattern_text`) by setting the index setting `index.logsdb.default_sort_on_message_template` to `true`. This will cause the index to be sorted by `host.name` (if present), then `message.template_id`, and finally by `@timestamp`. + +### Custom sorting +If the index is not LogsDB or the `pattern_text` field is named something other than `message`, index sorting can still be manually applied as shown in the following example. + ```console PUT logs { "settings": { "index": { - "mode": "logsdb", - "logsdb.default_sort_on_message_template": true + "sort.field": [ "notice.template_id", "@timestamp" ], + "sort.order": [ "asc", "desc" ] } }, "mappings": { @@ -94,7 +74,7 @@ PUT logs "@timestamp": { "type": "date" }, - "message": { + "notice": { "type": "pattern_text" } } @@ -103,6 +83,7 @@ PUT logs ``` + ## Parameters for pattern text fields [pattern-text-params] The following mapping parameters are accepted: