elasticsearch mapping问题解决

80 阅读 0 评论 53 点赞

我是靠谱客的博主舒心背包，最近开发中收集的这篇文章主要介绍elasticsearch mapping问题解决，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

1.报错信息如下：

[2018-07-16T00:10:17,743][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-api-2018.07.15", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x38a5460c>], :response=>{"index"=>{"_index"=>"filebeat-api-2018.07.15", "_type"=>"doc", "_id"=>"erO0nmQB3VHsYd1y-IbI", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [params.end_day]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: """}}}}}

日期格式不对报错，解决办法如下，建立一个map,关掉日期格式检测，对需要日期格式的字段加上date类型字段。这里也实现了field限制，将默认的1000加到了3000.

报错：

"reason"=>"object mapping for [params.commoditys] tried to parse field [commoditys] as object, but found a concrete value"}}}}

这个ignore_malformed设置为true解决

curl -XPUT "10.66.178.20:9200/_template/template_api" -H 'Content-Type: application/json' -d'{
"index_patterns":["filebeat-api-*"],
"order":0,
"settings":{
"number_of_replicas":0,
"index":{
"mapping":{
"ignore_malformed": true,
"total_fields": {
"limit": "3000"
}
}
}
},
"mappings": {
"doc": {
"date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
}
}
}
}
}'

转载于:https://www.cnblogs.com/mikeluwen/p/9318806.html