elasticsearch - 创建没有映射的Elasticsearch模板

Question

我需要创建一个模板，以对单个节点Elasticsearch集群具有一些通用的索引设置。当我运行以下查询时，它运行良好，但是新索引具有空映射，因此它拒绝所有输入。

我相信它会覆盖索引设置并删除所有映射。

PUT /_template/logstash
{
  "index_patterns": ["logstash-*"],
  "order" : 0,
  "settings": {
    "index": {
      "number_of_replicas": 0
    }
  }
}

这是我得到的错误的一瞥:

{"type": "server", "timestamp": "2019-12-23T02:06:12,383Z", "level": "DEBUG", "component": "o.e.a.b.TransportShardBulkAction", "cluster.name": "elasticsearch-cluster", "node.name": "elasticsearch", "message": "[logstash-2019.12.23][0] failed to execute bulk item (index) index {[logstash-2019.12.23][logevent][oGSBMG8Bk2kiyC1FN2uU], source[{\"@timestamp\":\"2019-12-23T05:04:44.0042561+03:00\",\"level\":\"Information\",\"messageTemplate\":\"HalalahContactService: Mobile Number: 123456789\",\"message\":\"ContactService: Mobile Number: 123456789\",\"fields\":{\"CorrelationId\":\"123456789\",\"MachineName\":\"INTERNAL-API02\"}}]}", "cluster.uuid": "1p7WBSRcQ6iCEJYflcALEQ", "node.id": "5nVSS69WRCiF_v3NsmsCHQ" ,
"stacktrace": ["java.lang.IllegalArgumentException: Rejecting mapping update to [logstash-2019.12.23] as the final mapping would have more than 1 type: [_doc, logevent]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:272) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:238) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.executeTasks(MasterService.java:702) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:324) ~[elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.runTasks(MasterService.java:219) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService.access$000(MasterService.java:73) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.MasterService$Batcher.run(MasterService.java:151) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:703) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:252) [elasticsearch-7.5.1.jar:7.5.1]",
"at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:215) [elasticsearch-7.5.1.jar:7.5.1]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]",
"at java.lang.Thread.run(Thread.java:830) [?:?]"] }

Answer 1

嗯，所以您的错误消息说明了一切!

自定义索引模板并不是真正的问题，要建立索引的文档确实是问题。从版本7开始，Elasticsearch不再允许每个索引使用多种类型，只有一个(现在默认为_doc)，以后将完全删除它们。

因此，问题实际上是，除了默认类型(可能是logevent)之外，其他类型都试图被索引。使这些索引类型保持一致即可使用。