如何更改使用Elasticsearch映射API

现有的索引字段类型我使用ELK并具有以下的文档结构如何更改使用Elasticsearch映射API

{ 
    "_index": "prod1-db.log-*", 
    "_type": "db.log", 
    "_id": "AVadEaq7", 
    "_score": null, 
    "_source": { 
    "message": "2016-07-08T12:52:42.026+0000 I NETWORK [conn4928242] end connection 192.168.170.62:47530 (31 connections now open)", 
    "@version": "1", 
    "@timestamp": "2016-08-18T09:50:54.247Z", 
    "type": "log", 
    "input_type": "log", 
    "count": 1, 
    "beat": { 
     "hostname": "prod1", 
     "name": "prod1" 
    }, 
    "offset": 1421607236, 
    "source": "/var/log/db/db.log", 
    "fields": null, 
    "host": "prod1", 
    "tags": [ 
     "beats_input_codec_plain_applied" 
    ] 
    }, 
    "fields": { 
    "@timestamp": [ 
     1471513854247 
    ] 
    }, 
    "sort": [ 
    1471513854247 
    ] 
}

我想了message字段更改为not_analyzed。我想知道如何使用Elasticsedarch Mapping API来实现？例如，如何使用PUT Mapping API向现有索引添加新类型？

我正在使用Kibana 4.5和Elasticsearch 2.3。开始logstash当

UPDATE 试图在logstash以下template.json，

1 { 
2 "template": "logstash-*", 
3 "mappings": { 
4  "_default_": { 
5  "properties": { 
6   "message" : { 
7   "type" : "string", 
8   "index" : "not_analyzed" 
9   } 
10  } 
11  } 
12 } 
13 }

得到了下面的错误，

logstash_1  | {:timestamp=>"2016-08-24T11:00:26.097000+0000", :message=>"Invalid setting for elasticsearch output plugin:\n\n output {\n elasticsearch {\n  # This setting must be a path\n  # File does not exist or cannot be opened /home/dw/docker-elk/logstash/core_mapping_template.json\n  template => \"/home/dw/docker-elk/logstash/core_mapping_template.json\"\n  ...\n }\n }", :level=>:error} 
logstash_1  | {:timestamp=>"2016-08-24T11:00:26.153000+0000", :message=>"Pipeline aborted due to error", :exception=>#<LogStash::ConfigurationError: Something is wrong with your configuration.>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/config/mixin.rb:134:in `config_init'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/outputs/base.rb:63:in `initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/output_delegator.rb:74:in `register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/agent.rb:473:in `start_pipeline'"], :level=>:error} 
logstash_1  | {:timestamp=>"2016-08-24T11:00:29.168000+0000", :message=>"stopping pipeline", :id=>"main"}

来源

2016-08-23 daiyue

当它已经存在，你不能更改索引的映射，除非您创建对象或多个字段的新字段。

如果您想使用您的要求是这样的映射API：

PUT /prod1-db.log-*/_mapping/log 
{ 
    "properties": { 
    "message": { 
     "type": "string", 
     "index": "not_analyzed" 
    } 
    } 
}

不过我建议你创建你的映射一个JSON文件，并将其添加到您的logstash配置。

模板文件看起来像这样（您需要定制此）：

{ 
    "template": "logstash-*", 
    "mappings": { 
    "_default_": { 
     "properties": { 
     "action" : { 
      "type" : "string", 
      "fields" : { 
      "raw" : { 
       "index" : "not_analyzed", 
       "type" : "string" 
      } 
      } 
     }, 
     "ad_domain" : { 
      "type" : "string" 
     }, 
     "auth" : { 
      "type" : "long" 
     }, 
     "authtime" : { 
      "type" : "long" 
     }, 
     "avscantime" : { 
      "type" : "long" 
     }, 
     "cached" : { 
      "type" : "boolean" 
     } 
     } 
    } 
    } 
}

而在你Logstash配置的elasticsearch条目是这样的：

elasticsearch { 
    template => "/etc/logstash/template/template.json" 
    template_overwrite => true 
}

来源

2016-08-23 15:22:41 Fairy

试图'PUT /prod1-db.log-*/_mapping/log { “属性”：{ “消息”：{ “类型”： “串”， “索引”： “not_analyzed” }但是从'elasticsearch'得到错误，'java.lang.IllegalArgumentException：无效的版本格式：{“PROPERTIES”：{“MESSAGE”：{“TYPE”：“STRING”，“INDEX”：“ NOT_ANALYZED“}}} HTTP/1.1' – daiyue

@daiyue你重新创建了索引吗？ – Fairy

重新创建索引是什么意思？如何在添加映射的组合中做到这一点？ – daiyue

如果你所有的避风港在创建索引时不会为索引创建任何映射，首次将文档索引到索引中时，弹性搜索会根据提供的数据自动为每个字段选择最佳映射。查看您在问题中提供的文档，elasticsearch将会为字段message分配一个分析器。分配后，您无法更改它。唯一的方法就是创建一个新的索引。

来源

2016-08-23 17:39:41

如何更改使用Elasticsearch映射API

回答

相关问题