By using GROK filter, We can add new field to Logstash.
But then, here I am wondering how to set the analyzer for that particular field.
For eg: , I have a new id field which has a field like a_b , but the the normal analyzer shipped by Elasticsearch, will break this into a and b. Because of this I can't apply the terms feature on that particular field efficiently and make it useful.
Here for the ID field, I want to apply a custom analyzer of my own, which don't tokenize the value but applied lowercase filter.
How can this be done in logstash.