我有一个名为srch_address的copy_to字段,在其中累积所有地址行并将其定义为“文本” 使它可搜索。但是,即使在logstash管道完成后,我也无法在索引中看到此字段 我也无法对其进行搜索。有人可以帮忙吗? 我在模板中有一个copy_to字段,如下所示:
{
"template": "demographics-template",
"version": 1,
"mappings": {
"_doc": {
"properties": {
"emp_id": {
"type": "keyword"
},
"address_line_1": {
"type": "keyword",
"copy_to": "srch_address"
},
"address_line_2": {
"type": "keyword",
"copy_to": "srch_address"
},
"address_line_3": {
"type": "keyword",
"copy_to": "srch_address"
},
"address_line_4": {
"type": "keyword",
"copy_to": "srch_address"
},
"address_line_5": {
"type": "keyword",
"copy_to": "srch_address"
},
"lst_updt_ts": {
"type": "date"
},
"srch_address": {
"type": "text"
}
}
}
}
}
我的logstash配置如下:
input {
jdbc {
#input configurations
jdbc_driver_library => "....jar"
jdbc_driver_class => "..."
jdbc_connection_string => "jdbc:db2://...."
jdbc_user => "***"
jdbc_password => "***"
statement =>
"SELECT *
FROM TBL1
WHERE LST_UPDT_TS > :sql_last_value
WITH UR"
use_column_value => true
tracking_column => "lst_updt_ts"
tracking_column_type => "timestamp"
last_run_metadata_path => "...."
}
}
output {
elasticsearch {
#output configurations
hosts => "http://localhost:9200/"
index => "demographics"
document_id => "%{emp_id}"
template_name => "demographics-template"
template_overwrite => false
}
stdout {
codec => rubydebug
}
}