“index”：“not_analyzed”在弹性搜索 [英] "index": "not_analyzed" in elasticsearch

问题描述

  curl -XDELETE'http：// localhost：9200 / logstash_log * /' 
  

在我的conf中，我已经将索引定义如下，

  output {
 elasticsearch {
 hosts => localhost 
 index => logstash_log  - ％{+ YYYY.MM.dd}
} 
  

并尝试创建一个新的映射，但是我收到错误

  #curl -XPUT http：// localhost：9200 / logstash_log * / _映射/ log -d'
 
 {
 
 
属性：{
@timestamp：type：date，format ：strict_date_optional_time || epoch_millis}，
message：{type：string}，
host：{type：ip}，
 name：{type：string，index：not_analyzed}，
type：{type：string} 
} 
 
 $'
  

{error：{root_cause [{type：index_not_found_exception，reason：no such index，resource.type：index_or_alias，resource.id：logstash_log *，index：logstash_log *} ]，type：index_not_found_exception，reason：no such index，resource.type：index_or_alias，resource.id：logstash_log *，index：logstash_log *} ，status：404}

我该如何解决？
任何帮助将不胜感激！

解决方案

您需要重新创建这样的索引：

 ＃curl -XPUT http：// localhost：9200 / logstash_log -d'{
mappings：{
log：{
properties：{
@timestamp：{
type：date，
format：strict_date_optional_time || epoch_millis 
}，
message：{
type：string
}，
host：{
type ip
}，
name：{
type：string，
index：not_analyzed
}，
type：{
type：string
} 
} 
} 
} 
}'
  

尽管看起来您正在从logstash创建每日索引，但您可能更好地创建一个模板。将以下内容存储在 index_template.json

  {
 template：logstash- *，
mappings：{
log：{
properties：{
@timestamp：{
type：date，
format：strict_date_optional_time || epoch_millis
}，
message：{
type：string
}，
host：{
type：ip
}，
name：{
type：string ，
index：not_analyzed
}，
type：{
type：string
} 
} 
} 
} 
} 
  

然后修改您的logstash配置，如这个：

  output {
 elasticsearch {
 hosts => localhost 
 index => logstash_log  - ％{+ YYYY.MM.dd}
 manage_template => true 
 template_name => logstash
 template => /path/to/index_template.json
 template_overwrite => true 
} 
  

i have delete mapping with the cmd

curl -XDELETE 'http://localhost:9200/logstash_log*/'

in my conf ,i have defined the index as follow,

output {
   elasticsearch {
   hosts => localhost
   index => "logstash_log-%{+YYYY.MM.dd}"
 }

and try to create a new mapping , but i got the error

 #curl -XPUT http://localhost:9200/logstash_log*/_mapping/log -d '

{


     "properties":{
          "@timestamp":"type":"date","format":"strict_date_optional_time||epoch_millis"},
           "message":{"type":"string"},
           "host":{"type":"ip"},
           "name":{"type":"string","index": "not_analyzed"},
           "type":{"type":"string"}
                }

}'

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"logstash_log*","index":"logstash_log*"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"logstash_log*","index":"logstash_log*"},"status":404}

How can i fix it? any help will be appreciated!!

解决方案

You need to re-create your index like this:

# curl -XPUT http://localhost:9200/logstash_log -d '{
  "mappings": {
    "log": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_millis"
        },
        "message": {
          "type": "string"
        },
        "host": {
          "type": "ip"
        },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "type": {
          "type": "string"
        }
      }
    }
  }
}'

Although since it looks like you're creating daily indices from logstash, you're probably better off creating a template instead. Store the following content inside index_template.json

{
  "template": "logstash-*",
  "mappings": {
    "log": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_millis"
        },
        "message": {
          "type": "string"
        },
        "host": {
          "type": "ip"
        },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        },
        "type": {
          "type": "string"
        }
      }
    }
  }
}

And then modify your logstash configuration like this:

output {
   elasticsearch {
   hosts => localhost
   index => "logstash_log-%{+YYYY.MM.dd}"
   manage_template => true
   template_name => "logstash"
   template => "/path/to/index_template.json"
   template_overwrite => true
}

这篇关于“index”：“not_analyzed”在弹性搜索的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！