今天导入了一些日志,看到mapping是这样的:
"logstash-2014.11.24" : {
"mappings" : {
"logs" : {
"dynamic_templates" : [ {
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "*",
"match_mapping_type" : "string"
}
} ],
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"host" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"lineno" : {
"type" : "long"
},
"message" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"path" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
}
}
}
}
}
请问dynamic_templates里面是什么意思?还有下面 "raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
这种又有什么作用呢?
"logstash-2014.11.24" : {
"mappings" : {
"logs" : {
"dynamic_templates" : [ {
"string_fields" : {
"mapping" : {
"index" : "analyzed",
"omit_norms" : true,
"type" : "string",
"fields" : {
"raw" : {
"index" : "not_analyzed",
"ignore_above" : 256,
"type" : "string"
}
}
},
"match" : "*",
"match_mapping_type" : "string"
}
} ],
"properties" : {
"@timestamp" : {
"type" : "date",
"format" : "dateOptionalTime"
},
"@version" : {
"type" : "string",
"index" : "not_analyzed"
},
"geoip" : {
"dynamic" : "true",
"properties" : {
"location" : {
"type" : "geo_point"
}
}
},
"host" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"lineno" : {
"type" : "long"
},
"message" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
"path" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
}
}
}
}
}
请问dynamic_templates里面是什么意思?还有下面 "raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
这种又有什么作用呢?
2 个回复
laigood
赞同来自: sdlyjzh 、Rubricate 、清风凌波 、juneryang
"match" : "*",
"match_mapping_type" : "string"
就是表示后来添加的所有string类型的字段都用这个模板,把字段mapping定义为:
"index" : "not_analyzed",
"ignore_above" : 256,//只保存256个字符
"type" : "string"
joeywen
赞同来自:
| field_id | field_name | field_value |
| 1 | multi_value | A,B,C |
| 2 | multi_value | A,B |
| 3 | multi_value | B,C,D |
| 4 | multi_value | D,E,F |
上个4个field,每个都是string类型,他们的field value都是一个字符串,那么如果想在查询multi_value: A 时匹配1,2 doc,查询multi_value: B匹配 1,2,3doc,查询multi_value: (A OR D)匹配 1,2,3,4 doc,同时查询multi_value: A,B 能够精确快速匹配2 doc,那么这个mapping定义
就是es中的支持一个field的multi value定义,对本身进行分词,支持部分匹配,然后raw不分词,支持精确匹配。
详细查看es文档 multi_value 的介绍