Question

我有一个名为“myproject-error-2016-08”的索引，它只有一个名为“error”的类型。

当我点击时：

GET myproject-error-2016-08/_mapping

返回以下结果：

{
   "myproject-error-2016-08": {
      "mappings": {
         "error": {
            "properties": {
               ...
               "responseCode": {
                  "type": "string"
               },
               ...
            }
         }
      }
   }
}

我需要将responseCode更新为not_analyzed，因此我使用以下reuest：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "index": "not_analyzed"
      }
   }
}

获得以下异常：

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
   },
   "status": 400
}

我也试过以下：

PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}

但它回复了同样的反应。

弹性搜索是：

$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91

Answer 1

一旦创建了字段，您就是cannot change the type。

但是，你绝对可以创建一个not_analyzed子字段，如下所示：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

然后，您需要re-index your data/logs才能填充该子字段，并且您可以在查询中引用responseCode.raw。

elasticsearch更新映射冲突异常

1 个答案: