建议我将聚合移动到基于doc_value的_id字段，因为在当前设置中，我正在发生JVM Heap爆炸。 不幸的是，我在复制它时遇到困难。
以下是我当前正在使用的模板。 任何尝试更改“ _id”或对其进行复制的尝试都会遇到“ [_ id]字段在[doc]中定义了两次” 。
PUT _template/iiii
{
"order" : 0,
"index_patterns" : [
"iiii-*"
],
"settings" : {
"index" : {
"codec" : "best_compression",
"mapping" : {
"total_fields" : {
"limit" : "1500"
}
},
"refresh_interval" : "30s",
"analysis" : {
"analyzer" : {
"my_custom_analyzer" : {
"type" : "custom",
"tokenizer" : "punctuation"
}
},
"tokenizer" : {
"punctuation" : {
"pattern" : "[ .,!?]",
"type" : "pattern"
}
}
},
"number_of_shards" : "3",
"number_of_replicas" : "1"
}
},
"mappings" : {
"doc" : {
"dynamic" : false,
"properties" : {
"log_timestamp" : {
"type" : "text"
},
"server" : {
"type" : "text",
"fields" : {
"keyword" : {
"norms" : false,
"ignore_above" : 20,
"type" : "keyword",
"index_options" : "freqs"
}
}
},
"level" : {
"type" : "text",
"fields" : {
"keyword" : {
"norms" : false,
"ignore_above" : 20,
"type" : "keyword",
"index_options" : "freqs"
}
}
},
"ip" : {
"type" : "ip"
},
"thread" : {
"norms" : false,
"ignore_above" : 20,
"type" : "keyword",
"index_options" : "freqs"
},
"message" : {
"type" : "text",
"fields" : {
"keyword" : {
"norms" : false,
"ignore_above" : 20,
"type" : "keyword",
"index_options" : "freqs"
}
}
},
"sent" : {
"type" : "date"
},
}
"time" : {
"type" : "date"
},
"logtime" : {
"type" : "text"
}
}
}
},
"aliases" : { }
}