Question

我创建了一个架构，然后添加了内容。一旦我添加内容，架构就会重复。我也有kibana跑在上面搜索。我无法弄清楚为什么会这样。 Kibana的数据显示正常，但我担心这可能会在未来引起一些问题。请帮忙。

我的架构

{
    "properties": {
        "ansible_fqdn": { "type": "string" },
        "ansible_hostname": { "type": "string" },
        "ansible_architecture": { "type": "string" },
        "ansible_distribution": { "type": "string" },
        "ansible_distribution_version": { "type": "string" },
        "ansible_os_family": { "type": "string" },
        "facter_ipaddress": { "type": "string" },
        "facter_kernelrelease": { "type": "string" },
        "facter_memorysize": { "type": "string" },
        "facter_physicalprocessorcount": { "type": "integer" },
        "facter_timezone": { "type": "string" },
        "facter_virtual": { "type": "string" },
        "primary_service_name": { "type": "string" },
        "pp_name": { "type": "string" },
        "wg_project_name": { "type": "string" },
        "primary_app_name": { "type": "string" },
        "location": { "type": "string" },
        "status": { "type": "string" },
        "pp_idx": { "type": "string" }
    }
}

架构帖子添加内容

{
  "systeminformation" : {
    "aliases" : { },
    "mappings" : {
      "ansible_facts" : {
        "properties" : {
          "ansible_architecture" : {
            "type" : "string"
          },
          "ansible_distribution" : {
            "type" : "string"
          },
          "ansible_distribution_version" : {
            "type" : "string"
          },
          "ansible_facts" : {
            "properties" : {
              "ansible_architecture" : {
                "type" : "string"
              },
              "ansible_distribution" : {
                "type" : "string"
              },
              "ansible_distribution_version" : {
                "type" : "string"
              },
              "ansible_fqdn" : {
                "type" : "string"
              },
              "ansible_hostname" : {
                "type" : "string"
              },
              "ansible_os_family" : {
                "type" : "string"
              },
              "facter_ipaddress" : {
                "type" : "string"
              },
              "facter_kernelrelease" : {
                "type" : "string"
              },
              "facter_memorysize" : {
                "type" : "string"
              },
              "facter_physicalprocessorcount" : {
                "type" : "long"
              },
              "facter_timezone" : {
                "type" : "string"
              },
              "facter_virtual" : {
                "type" : "string"
              },
              "status" : {
                "type" : "string"
              },
              "location" : {
                "type" : "string"
              },
              "pp_id" : {
                "type" : "string"
              },
              "pp_name" : {
                "type" : "string"
              },
              "primary_app_name" : {
                "type" : "string"
              },
              "primary_service_name" : {
                "type" : "string"
              },
              "wg_project_name" : {
                "type" : "string"
              }
            }
          },
          "ansible_fqdn" : {
            "type" : "string"
          },
          "ansible_hostname" : {
            "type" : "string"
          },
          "ansible_os_family" : {
            "type" : "string"
          },
          "facter_ipaddress" : {
            "type" : "string"
          },
          "facter_kernelrelease" : {
            "type" : "string"
          },
          "facter_memorysize" : {
            "type" : "string"
          },
          "facter_physicalprocessorcount" : {
            "type" : "string"
          },
          "facter_timezone" : {
            "type" : "string"
          },
          "facter_virtual" : {
            "type" : "string"
          },
          "status" : {
            "type" : "string"
          },
          "location" : {
            "type" : "string"
          },
          "pp_idx" : {
            "type" : "string"
          },
          "pp_name" : {
            "type" : "string"
          },
          "primary_app_name" : {
            "type" : "string"
          },
          "primary_service_name" : {
            "type" : "string"
          },
          "wg_project_name" : {
            "type" : "string"
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "creation_date" : "1470748490174",
        "uuid" : "r9Een_BXSf2cR3Cl2kb2Jg",
        "number_of_replicas" : "1",
        "number_of_shards" : "5",
        "version" : {
          "created" : "2030499"
        }
      }
    },
    "warmers" : { }
  }
}

正在添加的内容

{"ansible_facts": {"ansible_fqdn": "hostname.domain.com", "ansible_hostname": "hostname", "ansible_architecture": "x86_64", "ansible_distribution": "OracleLinux", "ansible_distribution_version": "6", "ansible_os_family": "RedHat", "facter_ipaddress": "10.10.10.10", "facter_kernelrelease": "2.6", "facter_memorysize": "16 GB", "facter_physicalprocessorcount": 2, "facter_timezone": "UTC", "facter_virtual": "vmware", "primary_service_name": "Something", "pp_name": "abc", "wg_project_name": "something", "primary_app_name": "something", "location": "", "status": "use", "pp_id": "P"}}

Answer 1

对我来说，看起来你做POST /my_index/ansible_facts/12345 {"ansible_facts": {"ansible_fqdn":....}}，而你应该做POST /my_index/ansible_facts/12345 {"ansible_fqdn":....}。

类型名称（ansible_facts）既在命令的URL中，也在命令的主体中。 the mapping itself is very flexible and is schema-free这意味着，如果您自己的映射中没有特别提及，Elasticsearch将为文档中的新数据创建字段。而且你从命令中的错误创建了一个新字段 - ansible_facts - 其中包含子字段。因此，从技术上讲，映射不会重复（ES不可能），它添加了一个新字段，一个包含许多子字段的字段。

ElasticSearch索引架构在添加内容后进行修改

1 个答案: