elasticsearch mapper_parsing_exception根映射定义的参数不受支持 [英] elasticsearch mapper_parsing_exception Root mapping definition has unsupported parameters

问题描述

在尝试创建模板时，elasticsearch 7存在以下问题.

I'm having the following issue with elasticsearch 7 when trying creating a template.

当我尝试将模板从elasticsearch 6复制到7时，我已经按照elasticsearch 7将某些字段删除了.e

When I'm trying to copy template from elasticsearch 6 to 7 and some of the fields I have removed as per the elasticsearch 7 .e

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
    }
  },
  "status": 400
}

映射模板:以下是我要发布的模板.

Mapping template: The following is the template I'm trying to post.

POST _template/logstash
{
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "mapper" : {

        }
      }
    },
    "mappings" : {
      "events" : {
        "properties" : {
          "msg" : {
            "type" : "text",
            "fields" : {
              "raw" : {
                "type" : "keyword"
              }
            }
          },
          "requestId" : {
            "type" : "keyword"
          },
          "logger" : {
            "type" : "keyword"
          },
          "host" : {
            "type" : "keyword"
          },
          "jwtOwner" : {
            "type" : "keyword"
          },
          "requestOriginator" : {
            "type" : "keyword"
          },
          "tag" : {
            "analyzer" : "firsttoken",
            "fields" : {
              "disambiguator" : {
                "analyzer" : "keyword",
                "type" : "text"
              }
            }
          },
          "jwtAuthenticatedUser" : {
            "type" : "keyword"
          },
          "thread" : {
            "type" : "keyword"
          },
          "requestChainOriginator" : {
            "type" : "keyword"
          },
          "revision" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  }

请帮助我解决问题.预先感谢.

Please help me resolve the issue. Thanks in advance.

推荐答案

有两个问题.一个问题是@OpsterESNinjaKamal提到的问题

There are two issues. One issue is the one mentioned by @OpsterESNinjaKamal

但是它仍然无法使用，因为 tag 字段没有类型.

But it still won't work as the tag field has no type.

以下是适用的模板:

PUT _template/logstash
{
  "order": 0,
  "index_patterns": [
    "logstash*"
  ],
  "settings": {
    "index": {
      "analysis": {
        "filter": {
          "firsttoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^([^\\.]*)\\.?.*$"
            ]
          },
          "secondtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          },
          "thirdtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          }
        },
        "analyzer": {
          "firsttoken": {
            "filter": [
              "firsttoken"
            ],
            "tokenizer": "keyword"
          },
          "secondtoken": {
            "filter": [
              "secondtoken"
            ],
            "tokenizer": "keyword"
          },
          "thirdtoken": {
            "filter": [
              "thirdtoken"
            ],
            "tokenizer": "keyword"
          }
        }
      },
      "mapper": {}
    }
  },
  "mappings": {
    "properties": {
      "msg": {
        "type": "text",
        "fields": {
          "raw": {
            "type": "keyword"
          }
        }
      },
      "requestId": {
        "type": "keyword"
      },
      "logger": {
        "type": "keyword"
      },
      "host": {
        "type": "keyword"
      },
      "jwtOwner": {
        "type": "keyword"
      },
      "requestOriginator": {
        "type": "keyword"
      },
      "tag": {
        "type": "text",                    <--- add type here
        "analyzer": "firsttoken",
        "fields": {
          "disambiguator": {
            "analyzer": "keyword",
            "type": "text"
          }
        }
      },
      "jwtAuthenticatedUser": {
        "type": "keyword"
      },
      "thread": {
        "type": "keyword"
      },
      "requestChainOriginator": {
        "type": "keyword"
      },
      "revision": {
        "type": "keyword"
      }
    }
  },
  "aliases": {}
}

这篇关于elasticsearch mapper_parsing_exception根映射定义的参数不受支持的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！