Question

我删除了cmd的映射

curl -XDELETE 'http://localhost:9200/logstash_log*/'

在我的conf中，我已将索引定义如下，

output {
   elasticsearch {
   hosts => localhost
   index => "logstash_log-%{+YYYY.MM.dd}"
 }

并尝试创建一个新的映射，但我收到了错误

 #curl -XPUT http://localhost:9200/logstash_log*/_mapping/log -d '

{


     "properties":{
          "@timestamp":"type":"date","format":"strict_date_optional_time||epoch_millis"},
           "message":{"type":"string"},
           "host":{"type":"ip"},
           "name":{"type":"string","index": "not_analyzed"},
           "type":{"type":"string"}
                }

}'

{＆＃34;错误＆＃34; {＆＃34; ROOT_CAUSE＆＃34;：[{＆＃34;类型＆＃34;：＆＃34; index_not_found_exception＆＃34;＆＃34;理由＆＃34 ;：＆＃34;没有这样的索引＆＃34;，＆＃34; resource.type＆＃34;：＆＃34; index_or_alias＆＃34;，＆＃34; resource.id＆＃34;：＆＃34; logstash_log * ＆＃34;＆＃34;指数＆＃34;：＆＃34; logstash_log *＆＃34;}]，＆＃34;类型＆＃34;：＆＃34; index_not_found_exception＆＃34;＆＃34;理由＆＃34;：＆＃34;没有这样的索引＆＃34;，＆＃34; resource.type＆＃34;：＆＃34; index_or_alias＆＃34;，＆＃34; resource.id＆＃34;：＆＃34; logstash_log *＆＃34;＆＃34;指数＆＃34;：＆＃34; logstash_log *＆＃34;}＆＃34;状态＆＃34;：404}

我该如何解决？任何帮助将不胜感激!!

Answer 1

您需要像这样重新创建索引：

# curl -XPUT http://localhost:9200/logstash_log -d '{
  "mappings": {
    "log": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_millis"
        },
        "message": {
          "type": "string"
        },
        "host": {
          "type": "ip"
        },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "type": {
          "type": "string"
        }
      }
    }
  }
}'

虽然看起来你正在从logstash创建每日索引，但你最好还是创建一个模板。将以下内容存储在index_template.json

中

{
  "template": "logstash-*",
  "mappings": {
    "log": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_millis"
        },
        "message": {
          "type": "string"
        },
        "host": {
          "type": "ip"
        },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "type": {
          "type": "string"
        }
      }
    }
  }
}

然后修改您的logstash配置，如下所示：

output {
   elasticsearch {
   hosts => localhost
   index => "logstash_log-%{+YYYY.MM.dd}"
   manage_template => true
   template_name => "logstash"
   template => "/path/to/index_template.json"
   template_overwrite => true
}

Answer 2

*是索引名称的无效字符。

索引名称不得包含以下字符[\，/，*，？，\“，＆lt;，＆gt;，| ,,,，

＆＃34;索引＆＃34;：＆＃34; not_analyzed＆＃34;在弹性搜索中

2 个答案: