字段和field.keyword之间的区别 [英] difference between a field and the field.keyword

问题描述

如果我将包含多个字段的文档添加到Elasticsearch索引中，那么当我在Kibana中查看该文档时，每次获得相同字段的次数都是两次.其中之一将被称为

If I add a document with several fields to an Elasticsearch index, when I view it in Kibana, I get each time the same field twice. One of them will be called

some_field

，另一个将被称为

some_field.keyword

这种行为是从哪里来的?两者之间有什么区别?

Where does this behaviour come from and what is the difference between both of them?

PS:其中一个是可聚合的(不确定这意味着什么)，而另一个(没有关键字)则是可聚合的.

PS: one of them is aggregatable (not sure what that means) and the other (without keyword) is not.

推荐答案

更新: 一个简短的答案是该类型:分析文本，表示文本已分解在存储时分成不同的单词，并允许在字段中对一个或多个单词进行自由文本搜索. .keyword字段采用相同的输入并保留为一个大字符串，这意味着可以对其进行汇总，并且可以在其上使用通配符搜索.可聚合意味着您可以在elasticsearch的聚合中使用它，如果您熟悉它，它类似于sql组.在Kibana中，您可能会将.keyword字段与聚合一​​起使用以计算不同的值，等等.

Update : A short answer would be that type: text is analyzed, meaning it is broken up into distinct words when stored, and allows for free-text searches on one or more words in the field. The .keyword field takes the same input and keeps as one large string, meaning it can be aggregated on, and you can use wildcard searches on it. Aggregatable means you can use it in aggregations in elasticsearch, which resembles a sql group by if you are familiar with that. In Kibana you would probably use the .keyword field with aggregations to count distinct values etc.

请查看有关 text与.keyword .

Please take a look on this article about text vs. keyword.

简而言之:由于Elasticsearch 5.0 string类型已由text和keyword类型取代.从那时开始，对于带有字符串的简单文档，请不要指定显式映射:

Briefly: since Elasticsearch 5.0 string type was replaced by text and keyword types. Since then when you are do not specify explicit mapping, for simple document with string:

{
  "some_field": "string value"
}

将在下面创建动态映射:

below dynamic mapping will be created:

{
  "some_field": {
    "type" "text",
    "fields": {
      "keyword": {
        "type": "keyword",
        "ignore_above": 256
      }
    }
  }
}

因此，既可以在some_field上执行全文本搜索，又可以使用some_field.keyword字段进行关键字搜索和聚合.

As a consequence, it will both be possible to perform full-text search on some_field, and keyword search and aggregations using the some_field.keyword field.

我希望这能回答您的问题.

I hope this answers your question.

这篇关于字段和field.keyword之间的区别的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！