如何在Elasticsearch中指定default-mapping.json

Question

我正在尝试添加default-mapping.json文件，但我不确定它是否已被读取。 我该如何正确测试呢？ 如果无法读取，如何指定Elasticsearch读取该文件？ 这是/ etc / default中的文件：

# Run Elasticsearch as this user ID and group ID
#ES_USER=elasticsearch
#ES_GROUP=elasticsearch

# Heap Size (defaults to 256m min, 1g max)
#ES_HEAP_SIZE=2g

# Heap new generation
#ES_HEAP_NEWSIZE=

# max direct memory
#ES_DIRECT_SIZE=

# Maximum number of open files, defaults to 65535.
#MAX_OPEN_FILES=65535

# Maximum locked memory size. Set to "unlimited" if you use the
# bootstrap.mlockall option in elasticsearch.yml. You must also set
# ES_HEAP_SIZE.
#MAX_LOCKED_MEMORY=unlimited

# Maximum number of VMA (Virtual Memory Areas) a process can own
#MAX_MAP_COUNT=262144

# Elasticsearch log directory
#LOG_DIR=/var/log/elasticsearch

# Elasticsearch data directory
#DATA_DIR=/var/lib/elasticsearch

# Elasticsearch work directory
#WORK_DIR=/tmp/elasticsearch

# Elasticsearch configuration directory
#CONF_DIR=/etc/elasticsearch

# Elasticsearch configuration file (elasticsearch.yml)
#CONF_FILE=/etc/elasticsearch/elasticsearch.yml

# Additional Java OPTS
#ES_JAVA_OPTS=

# Configure restart on package upgrade (true, every other setting will lead to not restarting)
#RESTART_ON_UPGRADE=true

然后这是放在/ etc / elasticsearch中的default-mapping.json

{
    "_default_": {
        "_all": { "enabled": false },
        "_source": { "compress": true },
         "properties" : {
            "message" : { "type" : "string", "index" : "analyzed" },
            "source_host" : { "type" : "string", "index" : "not_analyzed" },
            "tags": { "type": "string", "index" : "not_analyzed" },
            "@timestamp" : { "type" : "date", "index" : "not_analyzed" },
            "type" : { "type" : "string", "index" : "not_analyzed" }
        }
    }
}

Answer 1

在elasticsearch中创建默认映射的好方法是通过模板 ，这是你的样子：

{
    "template_11": {
        "template": "*",
        "mappings": {
            "_default_": {
                "_all": {
                    "enabled": false
                },
                "_source": {
                    "compress": true
                },
                "properties": {
                    "message": {
                        "type": "string",
                        "index": "analyzed"
                    },
                    "source_host": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "tags": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "@timestamp": {
                        "type": "date",
                        "index": "not_analyzed"
                    },
                    "type": {
                        "type": "string",
                        "index": "not_analyzed"
                    }
                }
            }
        }
    }
}

将此模板放在$config_dir/templates/template_11.json

如果您不确定路径是什么，请查看https://stackoverflow.com/a/23338461/1619406

例如，我的是/usr/share/elasticsearch/config/templates/templates_11.json

现在，每次创建新索引时，它都将使用此模板作为默认映射。

希望这可以帮助，

参考文献：

索引模板

默认映射

---

更新 ：根据此答案 ，上述答案不再适用于版本2.x或5.x，它在文档和讨论中引用了这两个链接。

Answer 2

使用/ analyze端点测试用于索引字段值的分析器。

curl -s -XGET'http ：// localhost：9200 / url-test / _analyze？text = http://example.com&pretty '

您需要定义要搜索的原始字段（未分析）

"fieldname": {
          "type": "string",
          "norms": {
            "enabled": false
          },
          "fielddata": {
            "format": "disabled"
          },
          "fields": {
             "raw" : {"type": "string",
                      "index" : "not_analyzed",
                      "doc_values" : true,
                      "ignore_above" : 256
                     }
               }
        },