How to display match_body in the elastalert metadata with writeback index?

[vutuong]

I want to display all documents matching a selected rule, and these documents must include information in the match_body field of the write_back_index named "test."

However, the default mapping for this index is created using the elastalert-create-index command, and the match_body field is mapped as disabled with the following configuration when show the mapping of write-back-index:

...
"match_body": {
    "type": "object",
    "enabled": false
}
...

How can I enable it? I cannot create the index template before running the elastalert-create-index command because this command will attempt to apply the mapping again, causing an error.

[jertel]

Per Elasticsearch docs, the enabled field tells Elasticsearch not to waste time and space indexing that property but the data is still stored and accessible.

[vutuong]

@jertel I want to enable match_body in the Elasticsearch mapping to display and query it with Grafana. My workaround is to rebuild the container image and replace the es_mapping file from https://github.com/jertel/elastalert2/tree/master/elastalert/es_mappings with a new mapping that enables match_body.
I have one more question: What does match_time in in the meta_data? What is difference between match_time and alert_time?
I can not find it in the doc at: https://elastalert2.readthedocs.io/en/latest/elastalert_status.html

[jertel]

Why is this the accepted answer? It's not answering anything. Rather it's asking more questions.

If you want to query the match_body field then you will need to either bind a modified es_mapping file into the container using -v or modify the index after it was creating, using the Elasticsearch REST API. There is no need to build a new container image.

alert_time = The time that ElastAlert 2 sends the alert, or the original alert time if the alert failed to send, or slightly more complicated for aggregated alerts.
match_body = The original event timestamp. It will never be the same as alert_time.