Question

我在我的ElasticSearch模型中添加了一个新文件

PUT clients_index/_mapping/external 
{
  "properties": {
        "messagelvl" : { "type" : "string"} 
      }
}

然后我尝试以JSON格式发送这样的日志

{"messagelvl":"DEBUG","debug_timestamp":"2016-10-30 18:16:17,175","debug_thread":"main","debug_file":"DoSomeLogs.java", "debug_line":"18","debug_message":"DEGUB MESSAGE ID! 14"}

但我能看到的只是

DEGUB MESSAGE ID!

在我的弹性搜索日志中

@timestamp:October 30th 2016, 18:17:20.494 port:51,299 @version:1 host:127.0.0.1 message:playgroundxptERROR MESSAGE ID! 29tmainpw@pxy type:webserver_prod _id:AVgWKpsas5kNO8gnk1_6 _type:webserver_prod _index:clients_index _score: -

此外，我在messagelvl中看到了我的字段Hide Missing Fields，当我尝试按此字段搜索结果时

October 30th 2016, 18:17:20.494  -

我打开日志时的JSON模型是：

{
  "_index": "clients_index",
  "_type": "webserver_prod",
  "_id": "AVgWKpsas5kNO8gnk1_6",
  "_score": null,
  "_source": {
    "@timestamp": "2016-10-30T15:17:20.494Z",
    "port": 51299,
    "@version": "1",
    "host": "127.0.0.1",
    "message": "playgroundxpt\u0000\u0014ERROR MESSAGE ID! 29t\u0000\u0004mainpw\u0004\u0000\u0000@pxy",
    "type": "webserver_prod"
  },
  "fields": {
    "@timestamp": [
      1477840640494
    ]
  },
  "sort": [
    1477840640494
  ]
}

我不明白为什么它没有为从JSON消息提交的messagelvl设置价值？

ElasticSearch无法将值设置为添加的附加字段

0 个答案: