無需映射即可創建 Elasticsearch 模板

Question

我需要創建一個模板來為單節點Elasticsearch集群設置一些通用的索引設置。 當我運行以下查詢時，它工作正常，但是，新索引具有空映射，因此它拒絕所有輸入。

我相信它會覆蓋索引設置並刪除所有映射。

PUT /_template/logstash
{
  "index_patterns": ["logstash-*"],
  "order" : 0,
  "settings": {
    "index": {
      "number_of_replicas": 0
    }
  }
}

這是我得到的錯誤的一瞥：

{"type": "server", "timestamp": "2019-12-23T02:06:12,383Z", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "elasticsearch-cluster", "node.name": "elasticsearch", "message": "[logstash-2019.12.23][0] failed to execute bulk item (index) index {[logstash-2019.12.23][logevent][oGSBMG8Bk2kiyC1FN2uU], source[{\"@timestamp\":\"2019-12-23T05:04:44.0042561+03:00\",\"level\":\"Information\",\"messageTemplate\":\"HalalahContactService: Mobile Number: 123456789\",\"message\":\"ContactService: Mobile Number: 123456789\",\"fields\":{\"CorrelationId\":\"123456789\",\"MachineName\":\"INTERNAL-API02\"}}]}", "cluster.uuid": "1p7WBSRcQ6iCEJYflcALEQ", "node.id": "5nVSS69WRCiF_v3NsmsCHQ" ,
"stacktrace": ["java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2019.12.23] as the final mapping would have more than 1 type: [_doc, logevent]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:272) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:238) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:702) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:324) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:219) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.access$000(MasterService.java:73) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:151) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:703) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:252) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:215) [elasticsearch-7.5.1.jar:7.5.1]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]",
"at java.lang.Thread.run(Thread.java:830) [?:?]"] }

Answer 1

啊，所以你的錯誤信息說明了一切！

您的自定義索引模板並不是真正的問題，正在編入索引的文檔才是。 從第 7 版開始，Elasticsearch 不再允許每個索引有多個類型，只有一個類型（ _doc作為現在的默認值），以后將完全刪除它們。

所以問題實際上是正在嘗試索引的類型，而不是默認類型，可能是logevent 。 使這些索引類型一致，它就會起作用。