elasticsearch的mapping疑问

今天导入了一些日志,看到mapping是这样的:
"logstash-2014.11.24" : {
"mappings" : {
"logs" : {
"dynamic_templates" : [ {
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "*",
"match_mapping_type" : "string"
}
} ],
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"host" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"lineno" : {
"type" : "long"
},
"message" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"path" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
}
}
}
}
}
请问dynamic_templates里面是什么意思?还有下面 "raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
这种又有什么作用呢?
已邀请:

dynamic_templates是动态模板,就是为你以后增加字段时自动定义这些字段的mapping,比如你这个
"match" : "*",
"match_mapping_type" : "string"
就是表示后来添加的所有string类型的字段都用这个模板,把字段mapping定义为:
"index" : "not_analyzed",
"ignore_above" : 256,//只保存256个字符
"type" : "string"

joeywen

赞同来自:

补充解释一下raw的含义,上面定义的dynamic 模版index 是not_analyzed,那么这个field只能用于精确匹配,不能有前缀或者后缀匹配,举个例子:
| field_id        | field_name | field_value |
| 1                  | multi_value | A,B,C           |
| 2                   | multi_value | A,B   |
| 3                  | multi_value | B,C,D | 
| 4                  | multi_value | D,E,F |
上个4个field,每个都是string类型,他们的field value都是一个字符串,那么如果想在查询multi_value: A 时匹配1,2 doc,查询multi_value: B匹配 1,2,3doc,查询multi_value: (A OR D)匹配 1,2,3,4 doc,同时查询multi_value: A,B 能够精确快速匹配2 doc,那么这个mapping定义
"path" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}}

就是es中的支持一个field的multi value定义,对本身进行分词,支持部分匹配,然后raw不分词,支持精确匹配。
详细查看es文档 multi_value 的介绍
 

要回复问题请先登录注册