【发布时间】：2021-01-17 22:05:01
【问题描述】：
我已经使用 ElasticSearch 6 很长时间了，并设法为我最常用的字段应用了映射。最近，我创建了另一个集群 (v7.7)，但由于 default 已被弃用，因此无法应用相同的映射。我的映射中有一些嵌套对象。当我用 _doc 替换 default 时，我可以应用映射，但是所有传入 ES 的请求都将被拒绝并进入 Logstash 死信队列。 （我正在使用 logstash 并将我的应用程序日志发送到 ElasticSearch。这是我的映射 json：
"index_patterns": [
"logstash-*"
],
"settings": {
"index": {
"mapping": {
"total_fields": {
"limit": "50000"
}
},
"refresh_interval": "5s"
}
},
"mappings": {
"_default_": {
"_all": {
"norms": false
},
"properties": {
"@timestamp": {
"type": "date"
},
"name": {
"ignore_above": 64,
"type": "keyword"
},
"logger": {
"ignore_above": 64,
"type": "keyword"
},
"hostname": {
"ignore_above": 256,
"type": "keyword"
},
"pid": {
"type": "integer"
},
"level": {
"type": "short"
},
"v": {
"type": "short"
},
"env": {
"ignore_above": 64,
"type": "keyword"
},
"service": {
"ignore_above": 256,
"type": "keyword"
},
"message": {
"type": "text"
},
"module": {
"type": "keyword"
},
"subModule": {
"type": "keyword"
},
"docker": {
"properties": {
"container_id": {
"ignore_above": 512,
"type": "keyword"
},
"container_name": {
"ignore_above": 512,
"type": "keyword"
},
"image_id": {
"ignore_above": 512,
"type": "keyword"
},
"image_name": {
"ignore_above": 512,
"type": "keyword"
},
"command": {
"ignore_above": 512,
"type": "keyword"
},
"tag": {
"ignore_above": 512,
"type": "keyword"
},
"created": {
"type": "date"
}
}
},
"data": {
"type": "text"
},
"context": {
"properties": {
"trade": {
"properties": {
"id": {
"ignore_above": 64,
"type": "keyword"
}
}
},
"trader": {
"properties": {
"id": {
"ignore_above": 64,
"type": "keyword"
},
"email": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"payment": {
"properties": {
"id": {
"ignore_above": 64,
"type": "keyword"
}
}
},
"err": {
"properties": {
"message": {
"type": "text"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"stack": {
"type": "text"
},
"code": {
"ignore_above": 256,
"type": "keyword"
},
"file": {
"ignore_above": 256,
"type": "keyword"
},
"line": {
"type": "integer"
},
"cause": {
"properties": {
"message": {
"type": "text"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"stack": {
"type": "text"
},
"code": {
"ignore_above": 256,
"type": "keyword"
},
"file": {
"ignore_above": 256,
"type": "keyword"
},
"line": {
"type": "integer"
},
"cause": {
"properties": {
"message": {
"type": "text"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"stack": {
"type": "text"
},
"code": {
"ignore_above": 256,
"type": "keyword"
},
"file": {
"ignore_above": 256,
"type": "keyword"
},
"line": {
"type": "integer"
}
}
}
}
}
}
},
"req": {
"properties": {
"id": {
"ignore_above": 64,
"type": "keyword"
},
"remoteAddress": {
"type": "ip"
},
"remotePort": {
"type": "integer"
},
"method": {
"ignore_above": 32,
"type": "keyword"
},
"path": {
"type": "text"
},
"body": {
"type": "text"
},
"bodyLength": {
"type": "integer"
},
"headers": {
"type": "text"
}
}
},
"res": {
"properties": {
"statusCode": {
"type": "short"
},
"body": {
"type": "text"
},
"bodyLength": {
"type": "integer"
},
"headers": {
"type": "text"
},
"latency": {
"type": "integer"
}
}
},
"event": {
"properties": {
"eventName": {
"ignore_above": 256,
"type": "keyword"
},
"context": {
"type": "text"
},
"uuid": {
"ignore_above": 64,
"type": "keyword"
},
"time": {
"type": "long"
},
"attempts": {
"type": "short"
}
}
},
"task": {
"properties": {
"taskName": {
"ignore_above": 256,
"type": "keyword"
},
"context": {
"type": "text"
},
"uuid": {
"ignore_above": 64,
"type": "keyword"
},
"time": {
"type": "long"
},
"attempts": {
"type": "short"
},
"origin": {
"ignore_above": 128,
"type": "keyword"
}
}
}
}
},
"dlq": {
"properties": {
"eventFields": {
"type": "text"
},
"reason": {
"type": "text"
}
}
},
"tags": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
}
}
}
我想知道如何将它应用到 elasticSearch7？
这里是 ElasticSearch 错误：
[o.e.a.a.i.m.p.TransportPutMappingAction] [0c85334cb2d41154383d0174502e13f2] failed to put mappings on indices [[[__PATH__]]], type [logs]
java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2020.10.02] as the final mapping would have more than 1 type: [_doc, logs]
【问题讨论】：
标签： elasticsearch mapping logstash logstash-configuration