elasticsearch - 如何在elasticsearch中更改值的类型

Question

我正在尝试在Elasticsearch中对值进行地理映射，但是client_location的值类型设置为字符串，我想将其更改为geo_point。当我运行以下命令时，我得到:

#curl -XGET "http://core.z0z0.tk:9200/_all/_mappings/http?pretty"
{
  "packetbeat-2015.12.04" : {
    "mappings" : {
      "http" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "strict_date_optional_time||epoch_millis"
          },
          "beat" : {
            "properties" : {
              "hostname" : {
                "type" : "string"
              },
              "name" : {
                "type" : "string"
              }
            }
          },
          "bytes_in" : {
            "type" : "long"
          },
          "bytes_out" : {
            "type" : "long"
          },
          "client_ip" : {
            "type" : "string"
          },
          "client_location" : {
            "type" : "string"
          },
          "client_port" : {
            "type" : "long"
          },
          "client_proc" : {
            "type" : "string"
          },
          "client_server" : {
            "type" : "string"
          },
          "count" : {
            "type" : "long"
          },
          "direction" : {
            "type" : "string"
          },
          "http" : {
            "properties" : {
              "code" : {
                "type" : "long"
              },
              "content_length" : {
                "type" : "long"
              },
              "phrase" : {
                "type" : "string"
              }
            }
          },
          "ip" : {
            "type" : "string"
          },
          "method" : {
            "type" : "string"
          },
          "notes" : {
            "type" : "string"
          },
          "params" : {
            "type" : "string"
          },
          "path" : {
            "type" : "string"
          },
          "port" : {
            "type" : "long"
          },
          "proc" : {
            "type" : "string"
          },
          "query" : {
            "type" : "string"
          },
          "responsetime" : {
            "type" : "long"
          },
          "server" : {
            "type" : "string"
          },
          "status" : {
            "type" : "string"
          },
              "type" : {
            "type" : "string"
          }
        }
      }
    }
  }
}

当我运行以下命令以将值的类型从字符串更改为 geo_point时，出现以下错误:

# curl -XPUT "http://localhost:9200/_all/_mappings/http" -d '
> {
> "http" : {
>         "properties" : {
>           "client_location" : {
>             "type" : "geo_point"
>           }
>         }
>   }
> }
> '
{"error":{"root_cause":[{"type":"merge_mapping_exception","reason":"Merge failed with failures {[mapper [client_location] of different type, current_type [string], merged_type[geo_point]]}"}],"type":"merge_mapping_exception","reason":"Merge failed with failures {[mapper [client_location] of different type, current_type [string], merged_type [geo_point]]}"},"status":400}

有什么建议我应该如何正确更改类型？

提前致谢。

Answer 1

不幸的是，一旦创建了字段，就无法再更改其类型。最好的办法是删除索引，并使用适当的映射正确地重新创建它。

如果您不想立即删除索引，另一种临时解决方案是创建现有字段的子字段:

# curl -XPUT "http://localhost:9200/_all/_mappings/http" -d '{
  "http": {
    "properties": {
      "client_location": {
        "type": "string",
        "fields": {
          "geo": {
            "type": "geo_point"
          }
        }
      }
    }
  }
}'

然后，您可以使用 client_location.geo在查询中访问它。
还要注意，您必须重新索引数据才能填充该新子字段...这意味着您可能还需要删除索引并正确地重新创建它。

更新

安装Packetbeat之后，您需要确保按照此处所述自行安装Packetbeat模板(即不会自动完成):
https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-getting-started.html#packetbeat-template

curl -XPUT 'http://localhost:9200/_template/packetbeat' -d@/etc/packetbeat/packetbeat.template.json