用了Elasticsearch,一口气上5T

【求助】添加es的默认mapping模板的一些字段,但是出现报错

Elasticsearch | 作者 sweetpotato | 发布于2018年09月12日 | 阅读数:16835

PUT _template/default@template
{
"mappings": {
"_default_": {
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
}
}
}
}
}

想在初始化模板添加一些geoip的字段,但是报错
想请大神帮忙看看有什么问题
 
{
"error": {
"root_cause": [
{
"type": "action_request_validation_exception",
"reason": "Validation Failed: 1: template is missing;"
}
],
"type": "action_request_validation_exception",
"reason": "Validation Failed: 1: template is missing;"
},
"status": 400
}
已邀请:

laoyang360 - 《一本书讲透Elasticsearch》作者,Elastic认证工程师 [死磕Elasitcsearch]知识星球地址:http://t.cn/RmwM3N9;微信公众号:铭毅天下; 博客:https://elastic.blog.csdn.net

赞同来自: lovefirewall

参考一下:
PUT _template/template_2
{
"index_patterns": ["te*", "bar*"],
"settings": {
"number_of_shards": 1
},
"mappings": {
"_doc": {
"_source": {
"enabled": false
},
"properties": {
"geoip": {
"type": "object",
"dynamic": true,
"properties": {
"ip": {
"type": "ip",
"doc_values": true
},
"location": {
"type": "geo_point",
"doc_values": true
},
"latitude": {
"type": "float",
"doc_values": true
},
"longitude": {
"type": "float",
"doc_values": true
}
}
},
"created_at": {
"type": "date",
"format": "EEE MMM dd HH:mm:ss Z YYYY"
}
}
}
}
}

juin - 大数据开发

赞同来自:

啊不是找不到模板吗
_template/ 后面应该是跟具体的索引名称吧
 

zqc0512 - andy zhou

赞同来自:

名字。
 

sweetpotato - 90IT男

赞同来自:

这个就是那个默认模板名

sweetpotato - 90IT男

赞同来自:

[2018-09-12T17:34:51,433][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"test_nginx_access-2018.09.12", :_type=>"test_nginx_access", :_routing=>nil}, 2018-09-12T09:34:49.720Z elk %{message}], :response=>{"index"=>{"_index"=>"test_nginx_access-2018.09.12", "_type"=>"test_nginx_access", "_id"=>"AWXNIiQGowE--keGp5Zc", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"[geoip.location] is defined as an object in mapping
[test_nginx_access] but this name is already used for a field in other types"}}}}
顺便问下这个报错  是什么意思啊,是我的哪个参数写错了吗

lovefirewall

赞同来自:

为了也能够共享给大家清楚认识到,为什么复制系统默认的logstash模版修改后再次导入elasticsearch为一直报错说"type": "action_request_validation_exception","reason": "Validation Failed: 1: index patterns is missing;"
以下是我之前导入的模版内容,请大家仔细阅读
{
"nginx" : {
"order" : 0,
"version" : 60001,
"index_patterns" : [
"nginx-*"
],
"settings" : {
"index" : {
"refresh_interval" : "5s"
}
},
"mappings" : {
"_default_" : {
"dynamic_templtes" : [
{
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
},
{
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false,
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "keyword"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"location" : {
"type" : "geo_point"
},
"latitude" : {
"type" : "half_float"
},
"longitude" : {
"type" : "half_float"
}
}
}
}
}
},
"aliases" : { }
}
}
 对比了楼上大神给的能够成功导入的映射模版之后,修改了默认logstash模版的一个json嵌套后,能够导入成功的模版内容如下
{
"order" : 0,
"version" : 60001,
"index_patterns" : [
"nginx-*"
],
"settings" : {
"index" : {
"number_of_shards" : 1,
"refresh_interval" : "5s"
}
},
"mappings" : {
"_default_" : {
"dynamic_templates" : [
{
"message_field" : {
"path_match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false
}
}
},
{
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "text",
"norms" : false,
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
],
"properties" : {
"@timestamp" : {
"type" : "date"
},
"@version" : {
"type" : "keyword"
},
"geoip" : {
"dynamic" : true,
"properties" : {
"ip" : {
"type" : "ip"
},
"location" : {
"type" : "geo_point"
},
"latitude" : {
"type" : "half_float"
},
"longitude" : {
"type" : "half_float"
}
}
}
}
}
},
"aliases" : { }
}
觉得没区别的请仔细比对!请仔细比对!请仔细比对!
技术就是技术,容不得一点马虎!

要回复问题请先登录注册