为什么设置映射后，索引什么也不返回？

Question

我在 Windows 10 x64 上使用 Elasticsearch 7.12.0、Logstash 7.12.0、Kibana 7.12.0。 Logstash 配置文件logistics.conf

input {
  jdbc {
    jdbc_driver_library => "D:\\tools\\postgresql-42.2.16.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://localhost:5433/ld"
    jdbc_user => "xxxx"
    jdbc_password => "sEcrET"
    schedule => "*/5 * * * *"
    statement => "select * from inventory_item_report();"
    }
}

filter {
  uuid {
    target => "uuid"
  }
}

output {
  elasticsearch {
    hosts => "http://localhost:9200"
    index => "localdist"
    document_id => "%{uuid}"
    doc_as_upsert => "true"
    }
}

运行logstash

logstash -f logistics.conf

如果我没有显式设置映射，则查询

GET /localdist/_search
{
  "query": {
    "match_all": {}
  }
}

返回多个结果。

我的映射

POST localdist/_mapping
{
  
}

DELETE /localdist

PUT /localdist
{
  
}

POST /localdist
{
  
}

PUT localdist/_mapping
{
  "properties": {
    "unt_cost": {
      "type": "double"
    },
    "ii_typ": {
      "type": "keyword"
    },
    "qty_uom_id": {
      "type": "keyword"
    },
    "prod_id": {
      "type": "keyword"
    },
    "root_cat_id": {
      "type": "keyword"
    },
    "uom": {
      "type": "keyword"
    },
    "product_name": {
      "type": "text"
    },
    "ii_id": {
      "type": "keyword"
    },
    "wght_uom_id": {
      "type": "keyword"
    },
    "iid_seq_id": {
      "type": "long"
    },
    "avai_diff": {
      "type": "double"
    },
    "invt_change_typ": {
      "type": "keyword"
    },
    "ccy": {
      "type": "keyword"
    },
    "exp_date": {
      "type": "date"
    },
    "req_amt": {
      "type": "text"
    },
    "pur_cost": {
      "type": "double"
    },
    "tot_pri": {
      "type": "long"
    },
    "own_pid": {
      "type": "keyword"
    },
    "doc_type": {
      "type": "keyword"
    },
    "ii_date": {
      "type": "date"
    },
    "fac_id": {
      "type": "keyword"
    },
    "shipment_type_id": {
      "type": "keyword"
    },
    "lot_id": {
      "type": "keyword"
    },
    "phy_invt_id": {
      "type": "keyword"
    },
    "facility_name": {
      "type": "text"
    },
    "amt_ohand_diff": {
      "type": "double"
    },
    "reason_id": {
      "type": "keyword"
    },
    "cat_id": {
      "type": "keyword"
    },
    "qty_ohand_diff": {
      "type": "double"
    },
    "@timestamp": {
      "type": "date"
    }
  }
}

运行查询

GET /localdist/_search
{
  "query": {
    "match_all": {}
  }
}

什么都不返回。

如何解决它，如何使显式映射正常工作？

Answer 1

如果我没听错的话，您就是通过 logstash 进行索引的。如果缺失，Elastic 然后创建索引，索引文档，并尝试根据第一个文档猜测文档的映射。

TL;DR：您正在自己删除包含数据的索引。

有

DELETE /localdist

您正在删除包括所有数据在内的整个索引。之后，通过发出

PUT /localdist
{
  
}

您正在重新创建先前删除的索引，该索引再次为空。最后，您正在设置索引映射

PUT localdist/_mapping
{
  "properties": {
    "unt_cost": {
      "type": "double"
    },
    "ii_typ": {
      "type": "keyword"
    },
    ...

现在，由于您有一个带有映射集的空弹性索引，请再次启动 logstash 管道。如果您的文档与索引映射匹配，则文档应该会很快开始出现。