elasticsearch - 如何在Logstash上定义特定的字段标记

Question

我正在使用logstash在elasticsearch上索引一些mysql数据:

input {
    jdbc {
      // JDBC configurations
    }
}
output {
    elasticsearch {
        index => ""
        document_type => ""
        document_id => ""
        hosts => [ "" ]
    }
}

检查结果时，我发现elasticsearch会自动标记文本，如下所示:

"Foo/Bar" -> "Foo", "Bar"
"The thing" -> "The", "thing"
"Fork, Knife" -> "Fork", "Knife"

好吧，对我大多数 Realm 来说都可以。但是，我想要一个自定义标记器是一个特定的 Realm 。这是一个逗号分隔的字段(或分号分隔的字段)。因此应该是:

"Foo/Bar" -> "Foo/Bar"
"The thing" -> "The thing"
"Fork, Knife" -> "Fork", "Knife"

我徘徊着是否有办法在我的logstash配置中进行配置。

更新:

这是我拥有的索引的一个示例。具体字段是 kind:

{
  "index-name": {
    "aliases": {},
    "mappings": {
      "My-type": {
        "properties": {
          "@timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "@version": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "id": {
            "type": "long"
          },
          "text": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "",
        "number_of_shards": "",
        "number_of_replicas": "",
        "uuid": "",
        "version": {
          "created": ""
        }
      }
    },
    "warmers": {}
  }
} 

Answer 1

可以通过使用index template来实现。

首先删除您当前的索引:

DELETE index_name

然后使用 kind字段的适当映射为您的索引创建模板，如下所示:

PUT _template/index_name
{
  "template": "index-name",
  "mappings": {
    "My-type": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_millis"
        },
        "@version": {
          "type": "string"
        },
        "kind": {
          "type": "string",
          "index": "not_analyzed"
        },
        "id": {
          "type": "long"
        },
        "text": {
          "type": "string"
        },
        "version": {
          "type": "string"
        }
      }
    }
  }
}

然后，您可以再次运行Logstash，并且将使用正确的映射重新创建索引。