elasticsearch - 如何更改现有索引中一个字段的映射？ Elasticsearch

Question

我有映射索引:

GET /warhammer/_mapping

给我:

{
   "warhammer": {
      "mappings": {
         "logs": {
            "properties": {
               "@timestamp": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "@version": {
                  "type": "string"
               },
               "HostName": {
                  "type": "string"
               },
               "boosters": {
                  "type": "long"
               },
               "device_model": {
                  "type": "string"
               },
               "build_type": {
                  "type": "string"
               }....
}

我需要将字段 device_model的映射更改为 not_analysed!
我试过了:

PUT /warhammer/_mapping
{
    "device_model": { "type": "string",
    "fields": { "raw":
    { "type": "string", "index": "not_analyzed" } } }
}

还有这个:

PUT /warhammer/_mapping
{
    "device_model": { 
        "type": "string", 
        "fields":
            { "raw": 
                { "type": "string", 
                    "index": "not_analyzed" } 
        } 
    }
}

但这给了我:

  {
   "error": "ActionRequestValidationException[Validation Failed: 1: mapping type is missing;]",
   "status": 400
  }

我究竟做错了什么？请帮忙!

Answer 1

PUT /warhammer/_mapping/logs
{
  "properties": {
    "device_model": {
      "type": "string",
      "fields": {
        "raw": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}