templates - Elasticsearch模板未按预期工作

Question

所以我有一个Elasticsearch模板，可以通过Filebeat传递给ES。我也将Filebeat发送到logstash ...这是相关的东西。

Elasticsearch模板

{
"template": "filebeat-*",
"mappings": {
    "product__name": {
        "properties": {
            "@timestamp": {
                "type": "date",
                "format": "strict_date_optional_time||epoch_millis"
            },
            "@version": {
                "type": "text"
            },
            "beat": {
                "properties": {
                    "hostname": {
                        "type": "text"
                    },
                    "name": {
                        "type": "text"
                    }
                }
            },
            "class_method": {
                "type": "text"
            },
            "class_name": {
                "type": "text",
                "index": "true",
                "fielddata": "true"
            },
            "clientip": {
                "type": "ip"
            },
            "count": {
                "type": "long"
            },
            "host": {
                "type": "text"
            },
            "input_type": {
                "type": "text"
            },
            "log_level": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "log_message": {
                "type": "text",
                "index": "true"
            },
            "log_timestamp": {
                "type": "text"
            },
            "log_ts": {
                "type": "long"
            },
            "message": {
                "type": "text"
            },
            "offset": {
                "type": "long"
            },
            "query_params": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "sessionid": {
                "type": "text",
                "index": "true"
            },
            "source": {
                "type": "text"
            },
            "tags": {
                "type": "text"
            },
            "thread": {
                "type": "text",
                "index": "true"
            },
            "type": {
                "type": "text"
            },
            "user_account_combo": {
                "type": "text",
                "index": "true"
            },
            "version": {
                "type": "text"
            }
        }
    },
    "access": {
        "properties": {
            "@timestamp": {
                "type": "date",
                "format": "strict_date_optional_time||epoch_millis"
            },
            "@version": {
                "type": "text"
            },
            "beat": {
                "properties": {
                    "hostname": {
                        "type": "text"
                    },
                    "name": {
                        "type": "text"
                    }
                }
            },
            "clientip": {
                "type": "ip"
            },
            "count": {
                "type": "long"
            },
            "host": {
                "type": "text",
                "index": "true"
            },
            "input_type": {
                "type": "text"
            },
            "log_timestamp": {
                "type": "text"
            },
            "log_ts": {
                "type": "long"
            },
            "message": {
                "type": "text"
            },
            "offset": {
                "type": "long"
            },
            "query_params": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "response_time": {
                "type": "long"
            },
            "sessionid": {
                "type": "text",
                "index": "true"
            },
            "source": {
                "type": "text"
            },
            "statuscode": {
                "type": "long"
            },
            "tags": {
                "type": "text"
            },
            "thread": {
                "type": "text",
                "index": "true"
            },
            "type": {
                "type": "text",
                "index": "true"
            },
            "uripath": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "user_account_combo": {
                "type": "text",
                "index": "true"
            },
            "verb": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            }
        }
    }
}
}

filebeat配置(已修剪)

output.elasticsearch:
  hosts: ["10.10.43.210:9200"]
  template:
    name: filebeat
    path: "test-template.json"
    overwrite: true

output.logstash:
    hosts: ["10.10.43.210:5044"]
    worker: 2
    index: filebeat

Logstash配置(已整理)

output {
  stdout { }
  elasticsearch {
    hosts => "elasticsearch:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

最后...这是Kibana中显示的内容:



所以问题是:当我很清楚要什么类型成为我的所有类型并且不让logstash覆盖我的模板时，为什么在事物上看到.keyword字段？我想念什么吗？

Answer 1

Kibana 5.x为所有.keyword类型的字段生成string字段。这使您可以基于整个字段进行聚合。例如，如果您想对host字段的唯一值进行计数，则可以对host.keyword进行汇总。

因此，此行为并不意味着您的模板将被覆盖，而是Kibana的故意行为，使您可以对字符串字段进行汇总。如果要检查模板是否被Logstash覆盖，请使用curl elasticsearch:9200/{template_name}?pretty将显示您的索引映射。这可以帮助您验证索引是否正在使用所需的映射。