ElasticSearch - 将映射更改为字段

Question

我正在使用弹性搜索集群版本 1.7.2，并尝试更改其中一个字段的映射（我认为）以忽略此字符：'-'

该字段为“Request.Headers.Host”，其值可以包含“-”，如： “app-cdn.cap.com”

#curl -X GET http://10.2.5.181:9200?pretty
{
  "status" : 200,
  "name" : "log-zone-a",
  "cluster_name" : "cap-logs",
  "version" : {
    "number" : "1.7.2",
    "build_hash" : "e43676b1385b7f593f7202acbd816e8ec",
    "build_timestamp" : "2015-09-14T09:49:53Z",
    "build_snapshot" : false,
    "lucene_version" : "4.10.4"
  },
  "tagline" : "You Know, for Search"
}

我看到它与参数not_analyzed有关，并且根据我在网上找到的内容，我尝试了这个：

#curl -X PUT '{"mappings":{"logs":{"properties":{"Request.Headers.Host":{"type":"string","index":"not_analyzed"}}}}}' http://10.2.5.181:9200/logstash-2016.12.27/logs/_mapping?pretty
curl: (3) [globbing] nested braces not supported at pos 13
{
  "error" : "ActionRequestValidationException[Validation Failed: 1: mapping source is empty;]",
  "status" : 400
}
#curl -H 'Accept: application/json' -X PUT http://10.2.5.181:9200/logstash-2016.12.27?pretty -d @/home/moses/mapping.json
{
  "error" : "RemoteTransportException[[log-zone-b][inet[/10.2.105.181:9300]][indices:admin/create]]; nested: IndexAlreadyExistsException[[logstash-2016.12.27] already exists]; ",
  "status" : 400
}

#cat /home/moses/mapping.json | jq .
{
  "logstash-2016.12.27": {
    "mappings": {
      "logs": {
        "properties": {
          "Request.Headers.Host": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    }
  }
}

当我更改映射并对不存在的索引执行相同操作时，它成功但索引似乎错误，将“Request.Headers.Host”与点分开:(

#cat /home/moses/mapping.json
{"Request.Headers.Host":{"type":"string","index":"not_analyzed"}}

    #curl -H 'Accept: application/json' -X PUT http://10.2.5.181:9200/logstash-2016.12.30?pretty -d @/home/moses/mapping.json
    {
      "acknowledged" : true
    }

#curl -H 'Accept: application/json' -X GET http://10.2.5.181:9200/logstash-2016.12.30?pretty
{
"logstash-2016.12.30" : {
"aliases" : { },
"mappings" : { },
"settings" : {
  "index" : {
    "creation_date" : "1483011476137",
    "Request" : {
      "Headers" : {
        "Host" : {
          "type" : "string",
          "index" : "not_analyzed"
        }
      }
    },
    "uuid" : "M6Ly0wvwTGu1aulSViYcPg",
    "number_of_replicas" : "1",
    "number_of_shards" : "5",
    "version" : {
      "created" : "1070299"
    }
  }
},
"warmers" : { }
  }
}

如何将这种映射配置设置为当前索引和未来索引？

谢谢， 摩西

Answer 1

要正确设置“Request.Headers.Host”等内部字段的映射，您必须定义多个级别：

{
  "logs" : {
    "properties" : {
      "Request" : {
        "properties" : {
          "Headers" : {
            "properties": {
              "Host": {
               "type" : "string",
               "index": "not_analyzed"
              }
            }
          }
        }
      }
    }
  }
}