用了Elasticsearch,一口气上5T

关于ES创建索引模板的问题

Elasticsearch | 作者 chen31577 | 发布于2018年01月04日 | 阅读数:6586

es版本5.4.0
通过logstash收集日志,按照日期每天新建索引。对文档的字符串类型做aggs操作。打算通过raw field not analyzed来定义mapping,实现一些聚合操作。但是创建template的语句提示错误。请高手指点如何创建这类索引。
put /_template/template_log
{
  "template": "logstash-log*",
  "mappings": {
    "gw-apache": {
      "properties": {
        "url": {
          "type" :"text",
          "fileds":{
            "raw":{
              "type":"text",
              "index":"not_analyzed"
            }
          }
        }
      }
    }
  }
}
以上语句通过kibana dev tools执行提示一下错误:
{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Mapping definition for
已邀请:

rockybean - Elastic Certified Engineer, ElasticStack Fans,公众号:ElasticTalk

赞同来自:

你报错信息贴的也太少了
估计是 index 设置为 not_analyzed  的问题,5.x 都是通过 type 为 keyword 来实现了,index 已经没有 not_analyzed  这一项了

chen31577 - oracle dba,正在学习ELK

赞同来自:

没注意报错信息被截掉了。以下是报错信息。谢谢提供的帮助!
{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Mapping definition for [url] has unsupported parameters:  [fileds : {raw={index=not_analyzed, type=text}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [gw_apache]: Mapping definition for [url] has unsupported parameters:  [fileds : {raw={index=not_analyzed, type=text}}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Mapping definition for [url] has unsupported parameters:  [fileds : {raw={index=not_analyzed, type=text}}]"
    }
  },
  "status": 400
}

要回复问题请先登录注册