Question

我有一个弹性搜索索引，如下所示，

 {
  "payment_transaction": {
    "mappings": {
      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date"
          }
        }
      }
    }
  }
}

我需要添加另外三个字段（年，月，日）。并且需要从现有字段（created_date）中分配值。 created_date的格式为 2016-11-22T22：20：21.000Z 。我怎样才能做到这一点？弹性搜索版本为5.0。

Answer 1

解决方法是使用copy_to映射选项将created_date字段复制到单独的文本字段。然后可以使用pattern_replace字符过滤器分析文本字段以提取年，月日，如下例所示：

示例：

put test 
{
    "settings": {
        "analysis": {
            "char_filter": {
                "year" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$1"
                },
                "month" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$2"
                },
                "day" : {
                    "type": "pattern_replace",
                       "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$3"
                }
            },
            "analyzer": {
                "year" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["year"]
                },
                "month" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["month"]
                },
                "day" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["day"]
                }

            }
        }
    }
}
put test/message_logs/_mapping
{


      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date",

            "copy_to" : ["year","month","day"]
          },
           "year": {
            "type": "text",
            "analyzer" : "year",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "month": {
                 "type": "text",
            "analyzer" : "month",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "day": {
               "type": "text",
            "analyzer" : "day",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          }
        }
      }


}

put test/message_logs/1 
{
    "created_date" : "2016-11-22T22:20:21.000Z"
}

post test/message_logs/_search
{
    "fielddata_fields": [
       "year",
       "month",
       "day"
    ]
}

<强>结果：

    {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1,
      "max_score": 1,
      "hits": [
         {
            "_index": "test",
            "_type": "message_logs",
            "_id": "1",
            "_score": 1,
            "_source": {
               "created_date": "2016-11-22T22:20:21.000Z"
            },
            "fields": {
               "month": [
                  "11"
               ],
               "year": [
                  "2016"
               ],
               "day": [
                  "22"
               ]
            }
         }
      ]
   }
}

fielddata不必是true，仅为示例目的而启用。

弹性搜索如何添加新字段并从现有字段中添加值

1 个答案: