Question

我正在使用elasticsearch cluster版本1.7.2，并尝试更改其中一个字段的映射（我认为）以忽略此字符：＆＃39; - ＆＃39;

该字段是＆＃39; Request.Headers.Host＆＃39;，该值可以包含＆＃39; - ＆＃39;喜欢：＆＃34; app-cdn.cap.com＆＃34;

#curl -X GET http://10.2.5.181:9200?pretty
{
  "status" : 200,
  "name" : "log-zone-a",
  "cluster_name" : "cap-logs",
  "version" : {
    "number" : "1.7.2",
    "build_hash" : "e43676b1385b7f593f7202acbd816e8ec",
    "build_timestamp" : "2015-09-14T09:49:53Z",
    "build_snapshot" : false,
    "lucene_version" : "4.10.4"
  },
  "tagline" : "You Know, for Search"
}

我看到它与参数not_analyzed有关，而且从我在网络上发现的内容中，我试过了这个：

#curl -X PUT '{"mappings":{"logs":{"properties":{"Request.Headers.Host":{"type":"string","index":"not_analyzed"}}}}}' http://10.2.5.181:9200/logstash-2016.12.27/logs/_mapping?pretty
curl: (3) [globbing] nested braces not supported at pos 13
{
  "error" : "ActionRequestValidationException[Validation Failed: 1: mapping source is empty;]",
  "status" : 400
}
#curl -H 'Accept: application/json' -X PUT http://10.2.5.181:9200/logstash-2016.12.27?pretty -d @/home/moses/mapping.json
{
  "error" : "RemoteTransportException[[log-zone-b][inet[/10.2.105.181:9300]][indices:admin/create]]; nested: IndexAlreadyExistsException[[logstash-2016.12.27] already exists]; ",
  "status" : 400
}

#cat /home/moses/mapping.json | jq .
{
  "logstash-2016.12.27": {
    "mappings": {
      "logs": {
        "properties": {
          "Request.Headers.Host": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    }
  }
}

当我改变映射并对非现有索引执行相同操作时，它的成功但索引似乎错了，将“Request.Headers.Host”分开。带点:(

#cat /home/moses/mapping.json
{"Request.Headers.Host":{"type":"string","index":"not_analyzed"}}

    #curl -H 'Accept: application/json' -X PUT http://10.2.5.181:9200/logstash-2016.12.30?pretty -d @/home/moses/mapping.json
    {
      "acknowledged" : true
    }

#curl -H 'Accept: application/json' -X GET http://10.2.5.181:9200/logstash-2016.12.30?pretty
{
"logstash-2016.12.30" : {
"aliases" : { },
"mappings" : { },
"settings" : {
  "index" : {
    "creation_date" : "1483011476137",
    "Request" : {
      "Headers" : {
        "Host" : {
          "type" : "string",
          "index" : "not_analyzed"
        }
      }
    },
    "uuid" : "M6Ly0wvwTGu1aulSViYcPg",
    "number_of_replicas" : "1",
    "number_of_shards" : "5",
    "version" : {
      "created" : "1070299"
    }
  }
},
"warmers" : { }
  }
}

如何将此类映射配置设置为当前索引和未来索引？

谢谢，摩西

Answer 1

要正确设置内部字段的映射，例如＆＃34; Request.Headers.Host＆＃34;，您必须定义多个级别：

{
  "logs" : {
    "properties" : {
      "Request" : {
        "properties" : {
          "Headers" : {
            "properties": {
              "Host": {
               "type" : "string",
               "index": "not_analyzed"
              }
            }
          }
        }
      }
    }
  }
}

ElasticSearch - 将映射更改为字段

1 个答案: