Question

我正在使用{ "_index": "prod1-db.log-*", "_type": "db.log", "_id": "AVadEaq7", "_score": null, "_source": { "message": "2016-07-08T12:52:42.026+0000 I NETWORK [conn4928242] end connection 192.168.170.62:47530 (31 connections now open)", "@version": "1", "@timestamp": "2016-08-18T09:50:54.247Z", "type": "log", "input_type": "log", "count": 1, "beat": { "hostname": "prod1", "name": "prod1" }, "offset": 1421607236, "source": "/var/log/db/db.log", "fields": null, "host": "prod1", "tags": [ "beats_input_codec_plain_applied" ] }, "fields": { "@timestamp": [ 1471513854247 ] }, "sort": [ 1471513854247 ] }并拥有以下文档结构

message

我想将not_analyzed字段更改为Elasticsedarch Mapping API。我想知道如何使用PUT Mapping API来实现这一目标？例如，如何使用Kibana 4.5向现有索引添加新类型？

我正在使用Elasticsearch 2.3和template.json。

UPDATE 在logstash，

中尝试了以下

 1 {
 2   "template": "logstash-*",
 3   "mappings": {
 4     "_default_": {
 5       "properties": {
 6         "message" : {
 7           "type" : "string",
 8           "index" : "not_analyzed"
 9         }
10       }
11     }
12   }
13 }

logstash

在启动logstash_1 | {:timestamp=>"2016-08-24T11:00:26.097000+0000", :message=>"Invalid setting for elasticsearch output plugin:\n\n output {\n elasticsearch {\n # This setting must be a path\n # File does not exist or cannot be opened /home/dw/docker-elk/logstash/core_mapping_template.json\n template => \"/home/dw/docker-elk/logstash/core_mapping_template.json\"\n ...\n }\n }", :level=>:error} logstash_1 | {:timestamp=>"2016-08-24T11:00:26.153000+0000", :message=>"Pipeline aborted due to error", :exception=>#<LogStash::ConfigurationError: Something is wrong with your configuration.>, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/config/mixin.rb:134:in `config_init'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/outputs/base.rb:63:in `initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/output_delegator.rb:74:in `register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/agent.rb:473:in `start_pipeline'"], :level=>:error} logstash_1 | {:timestamp=>"2016-08-24T11:00:29.168000+0000", :message=>"stopping pipeline", :id=>"main"}，

时出现以下错误

textView.setText("&#247;");

Answer 1

除非为对象或多字段创建新字段，否则无法更改索引已存在的映射。

如果您想使用Mapping API，那么您的请求将如下所示：

PUT /prod1-db.log-*/_mapping/log
{
  "properties": {
    "message": {
      "type": "string",
      "index": "not_analyzed"
    }
  }
}

但是，我建议您使用映射创建一个JSON文件，并将其添加到您的logstash配置中。

模板文件可能如下所示（您需要自定义）：

{
  "template": "logstash-*",
  "mappings": {
    "_default_": {
      "properties": {
        "action" : {
          "type" : "string",
          "fields" : {
            "raw" : {
              "index" : "not_analyzed",
              "type" : "string"
            }
          }
        },
        "ad_domain" : {
          "type" : "string"
        },
        "auth" : {
          "type" : "long"
        },
        "authtime" : {
          "type" : "long"
        },
        "avscantime" : {
          "type" : "long"
        },
        "cached" : {
          "type" : "boolean"
        }
      }
    }
  }
}

Logstash配置中的elasticsearch条目如下所示：

elasticsearch {
    template => "/etc/logstash/template/template.json"
    template_overwrite => true
}

Answer 2

如果您在创建索引时没有为字段指定任何映射，则第一次将文档索引到索引中时，弹性搜索会根据提供的数据自动为每个字段选择最佳映射。查看您在问题中提供的文档，elasticsearch已经为字段message分配了一个分析器。分配后，您无法更改它。唯一的方法是创建一个新的索引。

如何使用Elasticsearch Mapping API更改现有索引的字段类型

2 个答案: