ElasticSearch覆盖从文本到对象的映射 [英] ElasticSearch overriding mapping from text to object

问题描述

我正在尝试覆盖字段的映射.

I am trying to override a mapping for a field.

有一个默认的索引模板(我无法更改)，我正在用自定义模板覆盖它.

There is a default index template (which I can't change) and I am overriding it with a custom one.

默认索引具有消息"字段作为文本的映射，但是我需要使其像对象一样对待，并使其字段可索引/可搜索.

The default index has a mapping for "message" field as text, but I need to make it treated like an object and make its fields indexable/searchable.

这是默认的索引模板，顺序为10.

This is the default index template, with order 10.

{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "message_field": {
            "mapping": {
              "index": true,
              "norms": false,
              "type": "text"
            },
            "match": "message",
            "match_mapping_type": "string"
          }
        },
        ...
      ],
      "properties": {
        "message": {
          "doc_values": false,
          "index": true,
          "norms": false,
          "type": "text"
        },
        ...
      }
    }
  },
  "order": 10,
  "template": "project.*"
}

这是我的替代:

{
  "template" : "project.*",
  "order" : 100,
  "dynamic_templates": [
    {
      "message_field": {
        "mapping": {
          "type": "object"
        },
        "match": "message"
      }
    }
  ],
  "mappings": {
    "message": {
      "enabled": true,
      "properties": {
        "tag": {"type": "string", "index": "not_analyzed"},
        "requestId": {"type": "integer"},
        ...
      }
    }
  }
}

这很好用，但是我最终在"message"对象中定义了所有字段(tag，requestId，...).

This works nice, but I end up defining all fields (tag, requestId, ...) in the "message" object.

有没有办法使消息"对象中的所有字段都可索引/可搜索?

Is there a way to make all the fields in the "message" object indexable/searchable?

这是示例文档:

{
  "level": "30",
  ...
  "kubernetes": {
    "container_name": "data-sync-server",
    "namespace_name": "alitest03",
    ...
  },
  "message": {
    "tag": "AUDIT",
    "requestId": 1234,
    ...
    },
  }
  ...
}

尝试了很多事情，但我无法使其正常工作.

Tried lots of things, but I can't make it work.

我正在使用ElasticSearch 2.4.4版.

I am using ElasticSearch version 2.4.4.

推荐答案

您可以使用类似的东西:

{
  "template": "project.*",
  "order": 100,
  "mappings": {
    "<your document type here>": {
      "dynamic_templates": [
        {
          "message_field": {
            "mapping": {
              "type": "object"
            },
            "match": "message"
          }
        },
        {
          "message_properties": {
            "path_match": "message.*",
            "mapping": {
              "type": "string",
              "index": "not_analyzed"
            }
          }
        }
      ]
    }
  }
}

但是您可能必须使用 match_mapping_type

这篇关于ElasticSearch覆盖从文本到对象的映射的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！