elasticsearch - 执行ElasticSearch更新时的document_missing_exception

Question

我经历了几个与“document_missing_exception”问题相同的问题，但在我看来，它们不是同一个问题。我可以查询该文档，但是在尝试更新它时失败。
我的查询:

# search AuthEvent by sessionID
GET events-*/_search
{
  "size": "100",
  "query": {
      "bool": {
          "must": [{
                  "term": {
                      "type": {
                          "value": "AuthEvent"
                      }
                  }
              },
              {
                "term": {
                  "client.sessionID.raw": {
                    "value": "067d660a1504Y67FOuiiRIEkVNG8uYIlnK87liuZGLBcSmEW0aHoDXAHfu"
                  }
                }
              }
          ]
      }
  }
}

查询结果:

{
  "took" : 18,
  "timed_out" : false,
  "_shards" : {
    "total" : 76,
    "successful" : 76,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 6.705622,
    "hits" : [
      {
        "_index" : "events-2020.10.06",
        "_type" : "doc",
        "_id" : "2c675295b27a225ce243d2f13701b14222074eaf",
        "_score" : 6.705622,
        "_routing" : "067d660a1504Y67FOuiiRIEkVNG8uYIlnK87liuZGLBcSmEW0aHoDXAHfu",
        "_source" : {
          # some data
        }
      }
    ]
  }
}

更新请求:

POST events-2020.10.06/_doc/2c675295b27a225ce243d2f13701b14222074eaf/_update
{
  "doc" : {
    "custom" : {
      "testField" : "testData"
    }
  }
}

并更新结果:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "document_missing_exception",
        "reason" : "[_doc][2c675295b27a225ce243d2f13701b14222074eaf]: document missing",
        "index_uuid" : "5zhQy6W6RnWscDz7Av4_bA",
        "shard" : "1",
        "index" : "events-2020.10.06"
      }
    ],
    "type" : "document_missing_exception",
    "reason" : "[_doc][2c675295b27a225ce243d2f13701b14222074eaf]: document missing",
    "index_uuid" : "5zhQy6W6RnWscDz7Av4_bA",
    "shard" : "1",
    "index" : "events-2020.10.06"
  },
  "status" : 404
}

我对ElasticSearch还是很陌生，找不到任何此类行为的原因。我使用ElasticSearch 6.7.1 oss版本+ Kibana来处理数据。我也尝试了批量更新，但以相同的错误结束。

Answer 1

正如您在查询结果中看到的那样，您的文档已使用routing值建立索引，并且在更新请求中丢失了它。
尝试以下方法:

POST events-2020.10.06/_doc/2c675295b27a225ce243d2f13701b14222074eaf/_update?routing=067d660a1504Y67FOuiiRIEkVNG8uYIlnK87liuZGLBcSmEW0aHoDXAHfu
{
  "doc" : {
    "custom" : {
      "testField" : "testData"
    }
  }
}

如果使用 routing value为文档建立索引，则所有随后的获取，更新和删除操作也都必须使用该路由值进行。