将字符串的默认映射更改为“未分析"在 Elasticsearch 中 [英] Change default mapping of string to "not analyzed" in Elasticsearch

问题描述

在我的系统中，数据的插入总是通过logstash通过csv文件完成.我从不预先定义映射.但是每当我输入一个字符串时，它总是被分析，结果像hello I am Sinha 这样的条目被拆分为hello，我、am、Sinha.无论如何，我是否可以更改 elasticsearch 的默认/动态映射，以便所有字符串(无论索引如何)都被不分析?或者有没有办法在 .conf 文件中设置它?假设我的 conf 文件看起来像

In my system, the insertion of data is always done through csv files via logstash. I never pre-define the mapping. But whenever I input a string it is always taken to be analyzed, as a result an entry like hello I am Sinha is split into hello,I,am,Sinha. Is there anyway I could change the default/dynamic mapping of elasticsearch so that all strings, irrespective of index, irrespective of type are taken to be not analyzed? Or is there a way of setting it in the .conf file? Say my conf file looks like

input {  
      file {
          path => "/home/sagnik/work/logstash-1.4.2/bin/promosms_dec15.csv"
          type => "promosms_dec15"
          start_position => "beginning"
          sincedb_path => "/dev/null"
      }
}
filter {

    csv {
        columns => ["Comm_Plan","Queue_Booking","Order_Reference","Multi_Ordertype"]
        separator => ","
    }  
    ruby {
          code => "event['Generation_Date'] = Date.parse(event['Generation_Date']);"
    }

}
output {  
    elasticsearch { 
        action => "index"
        host => "localhost"
        index => "promosms-%{+dd.MM.YYYY}"
        workers => 1
    }
}

我希望所有的字符串都不分析，我不介意它是所有未来数据插入到elasticsearch的默认设置

I want all the strings to be not analyzed and I don't mind it being the default setting for all future data to be inserted into elasticsearch either

推荐答案

您可以查询您的字段的 .raw 版本.这是在 Logstash 1.3.1 中添加的:

You can query the .raw version of your field. This was added in Logstash 1.3.1:

我们提供的 logstash 索引模板为您索引的每个字段添加了一个.raw"字段.这些.raw"字段由logstash设置为not_analyzed"，这样就不会进行分析或标记化——我们的原始值按原样使用！

The logstash index template we provide adds a ".raw" field to every field you index. These ".raw" fields are set by logstash as "not_analyzed" so that no analysis or tokenization takes place – our original value is used as-is!

因此，如果您的字段名为 foo，您将查询 foo.raw 以返回 not_analyzed(未按分隔符拆分)版本.

So if your field is called foo, you'd query foo.raw to return the not_analyzed (not split on delimiters) version.

这篇关于将字符串的默认映射更改为“未分析"在 Elasticsearch 中的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！