es版本5.4.0
通过logstash收集日志，按照日期每天新建索引。对文档的字符串类型做aggs操作。打算通过raw field not analyzed来定义mapping，实现一些聚合操作。但是创建template的语句提示错误。请高手指点如何创建这类索引。
put /_template/template_log
{
"template": "logstash-log*",
"mappings": {
"gw-apache": {
"properties": {
"url": {
"type" :"text",
"fileds":{
"raw":{
"type":"text",
"index":"not_analyzed"
}
}
}
}
}
}
}
以上语句通过kibana dev tools执行提示一下错误：
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for
通过logstash收集日志，按照日期每天新建索引。对文档的字符串类型做aggs操作。打算通过raw field not analyzed来定义mapping，实现一些聚合操作。但是创建template的语句提示错误。请高手指点如何创建这类索引。
put /_template/template_log
{
"template": "logstash-log*",
"mappings": {
"gw-apache": {
"properties": {
"url": {
"type" :"text",
"fileds":{
"raw":{
"type":"text",
"index":"not_analyzed"
}
}
}
}
}
}
}
以上语句通过kibana dev tools执行提示一下错误：
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for
2 个回复
rockybean - Elastic Certified Engineer, ElasticStack Fans，公众号：ElasticTalk
赞同来自:
估计是 index 设置为 not_analyzed 的问题，5.x 都是通过 type 为 keyword 来实现了，index 已经没有 not_analyzed 这一项了
chen31577 - oracle dba,正在学习ELK
赞同来自:
{
"error": {
"root_cause": [
{
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [url] has unsupported parameters: [fileds : {raw={index=not_analyzed, type=text}}]"
}
],
"type": "mapper_parsing_exception",
"reason": "Failed to parse mapping [gw_apache]: Mapping definition for [url] has unsupported parameters: [fileds : {raw={index=not_analyzed, type=text}}]",
"caused_by": {
"type": "mapper_parsing_exception",
"reason": "Mapping definition for [url] has unsupported parameters: [fileds : {raw={index=not_analyzed, type=text}}]"
}
},
"status": 400
}