elasticsearch 如何在Elasticsearch中指定default-mapping.json

我试图添加一个default-mapping.json文件，但我不确定它是否已被读取。我怎样才能正确地测试它？如果无法读取，如何指定Elasticsearch来读取该文件？ 这是/etc/default中的文件：

# Run Elasticsearch as this user ID and group ID
#ES_USER=elasticsearch
#ES_GROUP=elasticsearch

# Heap Size (defaults to 256m min, 1g max)
#ES_HEAP_SIZE=2g

# Heap new generation
#ES_HEAP_NEWSIZE=

# max direct memory
#ES_DIRECT_SIZE=

# Maximum number of open files, defaults to 65535.
#MAX_OPEN_FILES=65535

# Maximum locked memory size. Set to "unlimited" if you use the
# bootstrap.mlockall option in elasticsearch.yml. You must also set
# ES_HEAP_SIZE.
#MAX_LOCKED_MEMORY=unlimited

# Maximum number of VMA (Virtual Memory Areas) a process can own
#MAX_MAP_COUNT=262144

# Elasticsearch log directory
#LOG_DIR=/var/log/elasticsearch

# Elasticsearch data directory
#DATA_DIR=/var/lib/elasticsearch

# Elasticsearch work directory
#WORK_DIR=/tmp/elasticsearch

# Elasticsearch configuration directory
#CONF_DIR=/etc/elasticsearch

# Elasticsearch configuration file (elasticsearch.yml)
#CONF_FILE=/etc/elasticsearch/elasticsearch.yml

# Additional Java OPTS
#ES_JAVA_OPTS=

# Configure restart on package upgrade (true, every other setting will lead to not restarting)
#RESTART_ON_UPGRADE=true

然后这是/etc/elasticsearch中的default-mapping.json

{
    "_default_": {
        "_all": { "enabled": false },
        "_source": { "compress": true },
         "properties" : {
            "message" : { "type" : "string", "index" : "analyzed" },
            "source_host" : { "type" : "string", "index" : "not_analyzed" },
            "tags": { "type": "string", "index" : "not_analyzed" },
            "@timestamp" : { "type" : "date", "index" : "not_analyzed" },
            "type" : { "type" : "string", "index" : "not_analyzed" }
        }
    }
}

---

在elasticsearch中创建默认映射的好方法是通过模板，如下所示：

{
    "template_11": {
        "template": "*",
        "mappings": {
            "_default_": {
                "_all": {
                    "enabled": false
                },
                "_source": {
                    "compress": true
                },
                "properties": {
                    "message": {
                        "type": "string",
                        "index": "analyzed"
                    },
                    "source_host": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "tags": {
                        "type": "string",
                        "index": "not_analyzed"
                    },
                    "@timestamp": {
                        "type": "date",
                        "index": "not_analyzed"
                    },
                    "type": {
                        "type": "string",
                        "index": "not_analyzed"
                    }
                }
            }
        }
    }
}

将此模板放入

$config\u dir/templates/template\u 11.json

如果您不确定您的路径，请检查

例如，我的是

/usr/share/elasticsearch/config/templates/templates_11.json

现在，每次创建新索引时，它都将使用此模板作为默认映射

希望这有帮助

参考资料：

---

---

更新：根据，上述答案不再适用于版本2.x或5.x，该版本引用了和中的这两个链接。

使用/analyze端点测试用于索引字段值的分析器

curl-s-XGET“

您需要定义一个原始字段（未分析）进行搜索

"fieldname": {
          "type": "string",
          "norms": {
            "enabled": false
          },
          "fielddata": {
            "format": "disabled"
          },
          "fields": {
             "raw" : {"type": "string",
                      "index" : "not_analyzed",
                      "doc_values" : true,
                      "ignore_above" : 256
                     }
               }
        },

---

你想在这里干什么？为什么要在默认映射文件中添加字段？当我查询Kibana中的字段时，我不希望它被空格标记而不是小写。我试图使Kibana中的字段不被空格标记，但它似乎不起作用。我应该如何正确地测试问题是什么？您也可以使用api来放置模板。请点击此处：