Question

我正在尝试在Elasticsearch中对值进行geomap，但client_location的值类型设置为字符串，我想将其更改为geo_point。当我运行以下内容时，我得到了：

#curl -XGET "http://core.z0z0.tk:9200/_all/_mappings/http?pretty"
{
  "packetbeat-2015.12.04" : {
    "mappings" : {
      "http" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "beat" : {
            "properties" : {
              "hostname" : {
                "type" : "string"
              },
              "name" : {
                "type" : "string"
              }
            }
          },
          "bytes_in" : {
            "type" : "long"
          },
          "bytes_out" : {
            "type" : "long"
          },
          "client_ip" : {
            "type" : "string"
          },
          "client_location" : {
            "type" : "string"
          },
          "client_port" : {
            "type" : "long"
          },
          "client_proc" : {
            "type" : "string"
          },
          "client_server" : {
            "type" : "string"
          },
          "count" : {
            "type" : "long"
          },
          "direction" : {
            "type" : "string"
          },
          "http" : {
            "properties" : {
              "code" : {
                "type" : "long"
              },
              "content_length" : {
                "type" : "long"
              },
              "phrase" : {
                "type" : "string"
              }
            }
          },
          "ip" : {
            "type" : "string"
          },
          "method" : {
            "type" : "string"
          },
          "notes" : {
            "type" : "string"
          },
          "params" : {
            "type" : "string"
          },
          "path" : {
            "type" : "string"
          },
          "port" : {
            "type" : "long"
          },
          "proc" : {
            "type" : "string"
          },
          "query" : {
            "type" : "string"
          },
          "responsetime" : {
            "type" : "long"
          },
          "server" : {
            "type" : "string"
          },
          "status" : {
            "type" : "string"
          },
              "type" : {
            "type" : "string"
          }
        }
      }
    }
  }
}

当我运行以下命令将值的类型从字符串更改为geo_point时，我收到以下错误：

# curl -XPUT "http://localhost:9200/_all/_mappings/http" -d '
> {
> "http" : {
>         "properties" : {
>           "client_location" : {
>             "type" : "geo_point"
>           }
>         }
>   }
> }
> '
{"error":{"root_cause":[{"type":"merge_mapping_exception","reason":"Merge failed with failures {[mapper [client_location] of different type, current_type [string], merged_type[geo_point]]}"}],"type":"merge_mapping_exception","reason":"Merge failed with failures {[mapper [client_location] of different type, current_type [string], merged_type [geo_point]]}"},"status":400}

有任何建议我应该如何正确更改类型？

提前致谢。

Answer 1

不幸的是，一旦你创建了一个字段，就不能再改变它的类型了。最好的办法是删除索引并使用适当的映射正确地重新创建它。

如果您不想立即删除索引，另一个临时解决方案是创建现有字段的子字段：

# curl -XPUT "http://localhost:9200/_all/_mappings/http" -d '{
  "http": {
    "properties": {
      "client_location": {
        "type": "string",
        "fields": {
          "geo": {
            "type": "geo_point"
          }
        }
      }
    }
  }
}'

然后，您可以使用client_location.geo在查询中访问它。另请注意，您必须重新索引数据才能填充新的子字段...这意味着您也可以删除索引并正确地重新创建它。

<强>更新

安装Packetbeat后，您需要确保按照此处所述自行安装packetbeat模板（即不会自动完成）： https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-getting-started.html#packetbeat-template

curl -XPUT 'http://localhost:9200/_template/packetbeat' -d@/etc/packetbeat/packetbeat.template.json

如何在elasticsearch中更改值的类型

1 个答案: