Logstash + Elasticsearch 模板映射无法添加到 Elasticsearch答案

【问题标题】：Logstash + Elasticsearch template mapping fails to add to ElasticsearchLogstash + Elasticsearch 模板映射无法添加到 Elasticsearch
【发布时间】：2015-08-10 05:19:31
【问题描述】：

我正在尝试为 elasticsearch 中的所有 logstash 索引添加自定义模板，但是每当我添加一个时，logstash 都会在所有日志上引发 400 错误，并且无法向 elasticsearch 添加任何内容。

我正在使用 REST API 为 elasticsearch 添加模板：

POST _template/logstash

{
    "order": 0,
    "template" : "logstash*",
    "settings": {
        "index.refresh_interval": "5s"
    },
    "mappings": {
        "_default_": {
            "_all" : {
                "enabled" : true,
                "omit_norms": true
            },
            "dynamic_templates": [
                {
                    "message_field": {
                        "mapping": {
                            "index": "analyzed",
                            "omit_norms": true,
                            "type": "string"
                        },
                        "match_mapping_type": "string",
                        "match": "message"
                    }
                },
                {
                    "string_fields": {
                        "mapping": {
                            "index": "analyzed",
                            "omit_norms": true,
                            "type": "string",
                            "fields": {
                                "raw": {
                                    "ignore_above": 256,
                                    "index": "not_analyzed",
                                    "type": "string"
                                }
                            }
                        },
                        "match_mapping_type": "string",
                        "match": "*"
                    }
                }
            ],
            "properties": {
                "geoip": {
                    "dynamic": true,
                    "type": "object",
                    "properties": {
                        "location": {
                            "type": "geo_point"
                        }
                    }
                },
                "@version": {
                    "index": "not_analyzed",
                    "type": "string"
                },
                "@fields": {
                    "type": "object",
                    "dynamic": true,
                    "path": "full"
                },
                "@message": {
                    "type": "string",
                    "index": "analyzed"
                },
                "@source": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "method": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "requested": {
                    "type": "date",
                    "format": "dateOptionalTime",
                    "index": "not_analyzed"
                },
                "response_time": {
                    "type": "float",
                    "index": "not_analyzed"
                },
                "hostname": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "ip": {
                    "type": "string",
                    "index": "not_analyzed"
                },
                "error": {
                    "type": "string",
                    "index": "not_analyzed"
                }
            }
        }
    }
}

【问题讨论】：

请分享 1) 您愿意索引的示例日志消息，2) 您正在使用的 logstash 和 ES 的版本以及 3) 您的 logstash 配置。

标签： json rest elasticsearch logstash

【解决方案1】：

您应该尝试使用 logstash 添加模板，而不是直接使用 rest api。在您的 logstash 配置中：

output {
  elasticsearch {
    # add additional configurations appropriately
    template => # path to the template file you want to use
    template_name => "logstash"
    template_overwrite => true
  }
}

【讨论】：