更改ElasticSearch或LogStash中的默认分析器 [英] Changing the default analyzer in ElasticSearch or LogStash

问题描述

我已经收到了来自Logstash的数据，这些数据是以过分的方式进行分析的。基本上，字段OS X 10.8将被分解为OS， X和10.8。我知道我可以更改现有数据的映射和重新索引，但是如何更改默认分析器（在ElasticSearch或LogStash中），以避免将来的数据出现此问题？

具体解决方案：在我首次将数据发送到新集群之前，我创建了类型的映射。

IRC的解决方案：创建一个索引模板

解决方案

如您所知，在没有明确指定分析器的情况下，elasticsearch使用标准分析器。所以在设置模板时，可以设置名为标准的自定义分析器。在那里你可以设置自己的设置分析器，tokenzier，令牌过滤器的规则。

以下是一些有用的链接，可以帮助您更好地了解：

http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/analysis.html

I've got data coming in from Logstash that's being analyzed in an overeager manner. Essentially, the field "OS X 10.8" would be broken into "OS", "X", and "10.8". I know I could just change the mapping and re-index for existing data, but how would I change the default analyzer (either in ElasticSearch or LogStash) to avoid this problem in future data?

Concrete Solution: I created a mapping for the type before I sent data to the new cluster for the first time.

Solution from IRC: Create an Index Template

解决方案

As you know, elasticsearch uses standard analyzer when no analyzer is specified explicitly. So while setting the templates, you can set your custom analyzer which is named as standard. And there you can set you own rules of setting analyzer, tokenzier, token filters.

Here are some helpful links that will help you understand better:

http://elasticsearch-users.115913.n3.nabble.com/How-we-can-change-Elasticsearch-default-analyzer-td4040411.html

http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/analysis.html

这篇关于更改ElasticSearch或LogStash中的默认分析器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！