字段和 field.keyword 之间的区别 [英] difference between a field and the field.keyword

问题描述

如果我将一个包含多个字段的文档添加到 Elasticsearch 索引中，当我在 Kibana 中查看它时，我每次都会得到两次相同的字段.其中之一将被称为

some_field

另一个将被称为

some_field.keyword

这种行为从何而来，两者有什么区别?

PS:其中一个是可聚合的(不确定这是什么意思)，另一个(没有关键字)不是.

解决方案

更新: 简短的回答是这样的:文本被分析，意味着它被分解存储时转换为不同的词，并允许对字段中的一个或多个词进行自由文本搜索..keyword 字段采用相同的输入并保留为一个大字符串，这意味着可以对其进行聚合，并且您可以对其使用通配符搜索.可聚合意味着您可以在 elasticsearch 的聚合中使用它，如果您熟悉它，它类似于 sql group by.在 Kibana 中，您可能会使用 .keyword 字段和聚合来计算不同的值等.

---

请看这篇关于text的文章 vs. keyword.

简而言之:自从 Elasticsearch 5.0 string 类型被替换为 text 和 keyword 类型.此后当您不指定显式映射时，对于带有字符串的简单文档:

<代码>{some_field":字符串值"；}

将创建以下动态映射:

<代码>{一些字段":{类型"文本"，字段":{关键字":{类型":关键字"，ignore_above":256}}}}

<块引用>

因此，既可以对 some_field 执行全文搜索，也可以使用 some_field.keyword 字段执行关键字搜索和聚合.

我希望这能回答您的问题.

If I add a document with several fields to an Elasticsearch index, when I view it in Kibana, I get each time the same field twice. One of them will be called

some_field

and the other one will be called

some_field.keyword

Where does this behaviour come from and what is the difference between both of them?

PS: one of them is aggregatable (not sure what that means) and the other (without keyword) is not.

解决方案

Update : A short answer would be that type: text is analyzed, meaning it is broken up into distinct words when stored, and allows for free-text searches on one or more words in the field. The .keyword field takes the same input and keeps as one large string, meaning it can be aggregated on, and you can use wildcard searches on it. Aggregatable means you can use it in aggregations in elasticsearch, which resembles a sql group by if you are familiar with that. In Kibana you would probably use the .keyword field with aggregations to count distinct values etc.

---

Please take a look on this article about text vs. keyword.

Briefly: since Elasticsearch 5.0 string type was replaced by text and keyword types. Since then when you do not specify explicit mapping, for simple document with string:

{
  "some_field": "string value"
}

below dynamic mapping will be created:

{
  "some_field": {
    "type" "text",
    "fields": {
      "keyword": {
        "type": "keyword",
        "ignore_above": 256
      }
    }
  }
}

As a consequence, it will both be possible to perform full-text search on some_field, and keyword search and aggregations using the some_field.keyword field.

I hope this answers your question.

这篇关于字段和 field.keyword 之间的区别的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！