Elasticsearch映射Geopoint不支持的参数

Question

我正在尝试设置一个ELK以与我的PaloAlto防火墙一起使用，但是我对映射感到困惑。 我有以下代码：

"mappings":{
  "_default_":{
     "_all":{
        "enabled":true
     },
     "dynamic_templates":[
        {
           "message_field":{
              "match":"message",
              "match_mapping_type":"string",
              "mapping":{
                 "type":"string",
                 "index":"analyzed",
                 "omit_norms":true
              }
           }
        },
        {
           "string_fields":{
              "match":"*",
              "match_mapping_type":"string",
              "mapping":{
                 "type":"string",
                 "index":"analyzed",
                 "omit_norms":true,
                 "fields":{
                    "raw":{
                       "type":"string",
                       "index":"not_analyzed",
                       "ignore_above":256
                    }
                 }
              }
           }
        }
     ],
     "properties":{
        "@version":{
           "type":"string",
           "index":"not_analyzed"
        },
        "geoip":{
           "type":"object",
           "dynamic":true,
           "path":"full",
           "properties":{
              "location":{
                 "type":"geo_point",
                 "lat_lon":true,
                 "geohash":true
              }
           }
        },

正如我在官方文档中所见， https： //www.elastic.co/guide/en/elasticsearch/reference/2.1/lat-lon.html您可以将参数lat_lon设置为true进行指定，以便对其值进行索引作为数字字段。

但是相反，我收到此错误：

{
  "error" : {
    "root_cause" : [
      {
        "type" : "mapper_parsing_exception",
        "reason" : "Mapping definition for [location] has unsupported parameters:  [geohash : true] [lat_lon : true]"
      }
    ],
    "type" : "mapper_parsing_exception",
    "reason" : "Failed to parse mapping [_default_]: Mapping definition for [location] has unsupported parameters:  [geohash : true] [lat_lon : true]",
    "caused_by" : {
      "type" : "mapper_parsing_exception",
      "reason" : "Mapping definition for [location] has unsupported parameters:  [geohash : true] [lat_lon : true]"
    }
  },
  "status" : 400
}

我做错了什么？

Answer 1

尝试删除lat_lon和geohash属性。 在当前的Elasticsearch版本（5.2）中，不支持这些属性。

以下应该可以解决问题：

    "geoip":{
       "dynamic":true,
       "properties":{
          "location":{
             "type":"geo_point"
          }
       }
    }

参考： https : //www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html

（如果您按照文档链接的建议运行2.1，请随时忽略我的回答）