templates - 尽管禁用了dynamic_mapping，但Logstash仍继续创建字段

Question

我已经定义了自己的模板，以供logstash使用，其中我已停用了动态映射:

{
    "my_index": {
        "order": 0,
        "template": "my_index",
        "settings": {
            "index": {
                "mapper": {
                    "dynamic": "false"
                },
                "analysis": {
                    "analyzer": {
                        "nlp_analyzer": {
                            "filter": [
                                "lowercase"
                            ],
                            "type": "custom",
                            "tokenizer": "nlp_tokenizer"
                        }
                    },
                    "tokenizer": {
                        "nlp_tokenizer": {
                            "pattern": ""
                            "(\w+)|(\s*[\s+])"
                            "",
                            "type": "pattern"
                        }
                    }
                },
                "number_of_shards": "1",
                "number_of_replicas": "0"
            }
        },
        "mappings": {
            "author": {
                "properties": {
                    "author_name": {
                        "type": "keyword"
                    },
                    "author_pseudo": {
                        "type": "keyword"
                    },
                    "author_location": {
                        "type": "text",
                        "fields": {
                            "standard": {
                                "analyzer": "standard",
                                "term_vector": "yes",
                                "type": "text"
                            },
                            "nlp": {
                                "analyzer": "nlp_analyzer",
                                "term_vector": "yes",
                                "type": "text"
                            }
                        }
                    }
                }
            }
        }
    }
}

为了测试elasticsearch是否不会生成新字段，我尝试让事件中的字段不存在于映射中，假设我有此事件:

{
“type” => “author”,
“author_pseudo” => “chloemdelorenzo”,
“author_name” => “Chloe DeLorenzo”,
“author_location” => “US”,
}

当索引该事件时，Elasticsearch将在映射中生成一个新字段:

"type": {
     "type": "text",
      "fields": {
           "keyword": {
                "type": "keyword",
                "ignore_above": 256
           }
      }
 }

我知道Logstash正在使用我的模板，因为在映射中我使用了自定义分析器，并且可以将其重新找到生成的映射中。但是显然，它没有考虑禁用动态字段。

我希望elasticsearch忽略映射中不存在的字段，但要索引具有已定义映射的字段。如何避免使用logstash创建新字段？

Answer 1

您应该在文档类型级别上执行映射。

https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-mapping.html

Regardless of the value of this setting, types can still be added explicitly when creating an index or with the PUT mapping API.

因此，您的映射将如下所示:

"mappings": {
    "author": {
        "dynamic": false,
        "properties": {
            "author_name": {
                "type": "keyword"
            },
            "author_pseudo": {
                "type": "keyword"
            },
            "author_location": {
                "type": "text",
                "fields": {
                    "standard": {
                        "analyzer": "standard",
                        "term_vector": "yes",
                        "type": "text"
                    },
                    "nlp": {
                        "analyzer": "nlp_analyzer",
                        "term_vector": "yes",
                        "type": "text"
                    }
                }
            }
        }
    }
}