无需映射即可创建 Elasticsearch 模板

Question

我需要创建一个模板来为单节点Elasticsearch集群设置一些通用的索引设置。 当我运行以下查询时，它工作正常，但是，新索引具有空映射，因此它拒绝所有输入。

我相信它会覆盖索引设置并删除所有映射。

PUT /_template/logstash
{
  "index_patterns": ["logstash-*"],
  "order" : 0,
  "settings": {
    "index": {
      "number_of_replicas": 0
    }
  }
}

这是我得到的错误的一瞥：

{"type": "server", "timestamp": "2019-12-23T02:06:12,383Z", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "elasticsearch-cluster", "node.name": "elasticsearch", "message": "[logstash-2019.12.23][0] failed to execute bulk item (index) index {[logstash-2019.12.23][logevent][oGSBMG8Bk2kiyC1FN2uU], source[{\"@timestamp\":\"2019-12-23T05:04:44.0042561+03:00\",\"level\":\"Information\",\"messageTemplate\":\"HalalahContactService: Mobile Number: 123456789\",\"message\":\"ContactService: Mobile Number: 123456789\",\"fields\":{\"CorrelationId\":\"123456789\",\"MachineName\":\"INTERNAL-API02\"}}]}", "cluster.uuid": "1p7WBSRcQ6iCEJYflcALEQ", "node.id": "5nVSS69WRCiF_v3NsmsCHQ" ,
"stacktrace": ["java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2019.12.23] as the final mapping would have more than 1 type: [_doc, logevent]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:272) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:238) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:702) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:324) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:219) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.access$000(MasterService.java:73) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:151) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:703) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:252) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:215) [elasticsearch-7.5.1.jar:7.5.1]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]",
"at java.lang.Thread.run(Thread.java:830) [?:?]"] }

Answer 1

啊，所以你的错误信息说明了一切！

您的自定义索引模板并不是真正的问题，正在编入索引的文档才是。 从第 7 版开始，Elasticsearch 不再允许每个索引有多个类型，只有一个类型（ _doc作为现在的默认值），以后将完全删除它们。

所以问题实际上是正在尝试索引的类型，而不是默认类型，可能是logevent 。 使这些索引类型一致，它就会起作用。