elasticsearch - 根映射定义具有不受支持的参数:[_timestamp:{enabled = true}]

Question

我正在尝试为ES 6.6.0设置以下映射，但出现此错误； Caused by: org.elasticsearch.index.mapper.MapperParsingException: Root mapping definition has unsupported parameters: [_timestamp : {enabled=true}]
我认为这最初来自ES2，但我不确定。类型不正确存在一些问题，因此我已将string和keyword属性的ActionName更改为UserName。

{
    "template": "audit_*",
    "aliases": {
        "{index}_read": {},
        "{index}_write": {},
        "{index}_verify": {}
    },
    "settings": {
        "index": {
                "number_of_shards": 12,
                "number_of_replicas": 2
        },
        "analysis": {
                "analyzer": {
                    "str_search_analyzer": {
                        "tokenizer": "keyword",
                        "filter": [
                            "lowercase",
                            "substring"
                            ]
                    },
                    "str_index_analyzer": {
                        "tokenizer": "keyword",
                        "filter": [
                            "lowercase",
                            "substring"
                            ]
                    },
                    "lwhitespace": {
                        "tokenizer": "whitespace",
                        "filter": [
                            "lowercase"
                            ]
                    }
                },
                "filter": {
                    "substring": {
                        "type": "nGram",
                        "min_gram": 1,
                        "max_gram": 20
                    }
                }
        }
    },
    "mappings": {
        "audit": {
                "dynamic_templates": [
                    {
                    "raw": {
                        "match_pattern": "regex",
                        "path_match": "Details\\.auditElement\\..*",
                        "mapping": {
                            "type": "string",
                            "fields": {
                            "Raw": {
                                "analyzer": "lwhitespace",
                                "type": "string"
                            }
                            }
                        },
                        "match_mapping_type": "string"
                    }
                    },
                    {
                    "newvalue": {
                        "match_pattern": "regex",
                        "path_match": ".*\\.newValue$",
                        "mapping": {
                            "type": "string",
                            "fields": {
                            "Raw": {
                                "analyzer": "lwhitespace",
                                "type": "string"
                            }
                            }
                        }
                    }
                    },
                    {
                    "oldvalue": {
                        "match_pattern": "regex",
                        "path_match": ".*\\.oldValue$",
                        "mapping": {
                            "type": "string",
                            "fields": {
                            "Raw": {
                                "analyzer": "lwhitespace",
                                "type": "string"
                            }
                            }
                        }
                    }
                    },
                    {
                    "analytics_text": {
                        "match_pattern": "regex",
                        "path_match": ".*\\.#text$",
                        "mapping": {
                            "type": "string",
                            "fields": {
                            "Raw": {
                                "analyzer": "lwhitespace",
                                "type": "string"
                            }
                            }
                        }
                    }
                    }
                ],
                "_timestamp": {
                    "enabled": true
                },
                "_size": {
                    "enabled": true
                },
                "properties": {
                    "ActionName": {
                        "type": "keyword",
                        "index": true
                    },
                    "TimeStamp": {
                       "type": "date",
                       "format": "strict_date_optional_time||epoch_millis"
                    },
                    "UserName": {
                        "type": "keyword",
                        "index": true
                    }
                }
        }
    }
}

Answer 1

您的直觉是正确的，_timestamp元字段was deprecated in 2.0:

The _timestamp field is deprecated. Instead, use a normal date field and set its value explicitly

此外， _size 元字段可能无法正常运行，因为它需要安装映射器大小的插件。

如果不需要这些字段，则应将它们从映射中删除。

我想您还必须更新动态映射中的类型(将 string替换为 keyword或 text)。

希望有帮助!