无法将非对象映射与机器学习(测试版)模块中的对象映射错误合并 [英] Can’t merge a non object mapping with an object mapping error in machine learning(beta) module
问题描述
我正在试用x pack中的新机器学习模块。我正在尝试及时识别HTTP Access日志中的罕见响应代码。我的日志存储在弹性搜索中,如下所示:
I'm trying out the new machine learning module in x pack. I'm trying to identify rare response codes in HTTP Access logs in time. My logs are being stored in elasticsearch as below:
{
"_index": "logstash-2017.05.18",
"_type": "Accesslog",
"_id": "AVxvVfFGdMmRr-0X-J5P",
"_version": 1,
"_score": null,
"_source": {
"request": "/web/Q123/images/buttons/asdf.gif",
"server": "91",
"auth": "-",
"ident": "-",
"verb": "GET",
"type": "Accesslog",
"path": "/path/to/log",
"@timestamp": "2017-05-18T10:20:00.000Z",
"response": "304",
"clientip": "1.1.1.1",
"@version": "1",
"host": "ip-10-10-10-10",
"httpversion": "1.1",
"timestamp": "18/May/2017:10:20:00 +0530"
},
"fields": {
"@timestamp": [
1495102800000
]
}
我在选择位置添加了一个检测器功能为罕见,by_field_name为响应。但是当我保存作业时,出现以下错误:
I added a detector where I selected the function as 'rare' and the by_field_name' as 'response'. But when I save the job I get the following error:
Save failed: [illegal_argument_exception] Can't merge a non object mapping [response] with an object mapping [response]
请帮助。
推荐答案
该错误消息表示您正在尝试更改现有映射。但是,这在Elasticsearch中是不可能的。创建映射后,就无法更改。
The error message means that you are trying to change an existing mapping. However, that is not possible in Elasticsearch. Once a mapping has been created, it cannot be changed.
您不能更改现有的映射类型,您需要创建一个具有正确映射的新索引
并再次为数据建立索引。
You can't change existing mapping type, you need to create a new index with the correct mapping and index the data again.
因此,您必须创建一个创建此映射的新索引。根据情况,您可以
So you must create a new index to create this mapping. Depending on the situation, you either
- 创建其他索引,或者
- 删除当前索引并从头开始重新创建它。
当然,在后一种情况下,您将丢失索引中的所有数据,因此请做好相应的准备。
Of course in the latter case you will lose all data in the index, so prepare accordingly.
这篇关于无法将非对象映射与机器学习(测试版)模块中的对象映射错误合并的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!