elasticsearch 用于ElasticSearch 6.2.4的filebeat-index-template.json

我正在运行ElasticSearch 6.2.4。我试图创建Filebeat索引模板，但出现以下错误

{
  "error" : {
    "root_cause" : [
      {
        "type" : "mapper_parsing_exception",
        "reason" : "No handler for type [string] declared on field [message]"
      }
    ],
    "type" : "mapper_parsing_exception",
    "reason" : "Failed to parse mapping [_default_]: No handler for type [string] declared on field [message]",
    "caused_by" : {
      "type" : "mapper_parsing_exception",
      "reason" : "No handler for type [string] declared on field [message]"
    }
  },
  "status" : 400
}

filebeat index.template.json

{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip"  : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "false",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "text",
          "index": "true"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip": {
          "type": "object",
          "dynamic": true,
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

我想知道是否有官方的filebeat index template.json适用于ElasticSearch 6.2.4

我试过的另一件事

• 尝试

  filebeat-c”/etc/filebeat/filebeat.yml“导出模板>filebeat.template.json

  ，但filebeat将永远运行，而不会创建任何内容
• 我尝试将

  “类型”：“字符串”

  更改为

  “类型”：“文本”

  ，但遇到另一个错误，其中

  \u all

  不推荐使用
• 我也尝试过删除所有的

  \u

  ，但是当Logstash将数据发送到ElasticSearch时，ElasticSearch一直存在解析错误

Filebeat版本[旧版] 我还试图找出我的Filebeat的版本。我试过了

> filebeat -v
Loading config file error: Failed to read /root/filebeat.yml: open /root/filebeat.yml: no such file or directory. Exiting.

> filebeat -v -c "/etc/filebeat/filebeat.yml"
(it struck forever) 

我遵循这一点，但不是使用ElasticSearch 2.0和Kibana 4.5，而是安装ElasticSearch 6.2.4、Kibana 6.2.4、Logstash 6.2.4和Ubuntu 16.04.4 LTS

升级到Filebeat 6.2.4 现在我正在将Filebeat升级到6.2.4。现在我得到了这个错误

Exiting: Could not start registrar: Error loading state: Error decoding states: json: cannot unmarshal object into Go value of type []file.State

---

我通过

rm/var/lib/filebeat/registry

删除了这个错误。现在我可以做

filebeat export-template>template.json

，它现在可以正常工作了。我将很快结束这个问题。

尝试将此弹性6.0修改的json用于filebeat index.template.json

{
  "mappings": {
    "_default_": {
      "_all": {
        "enabled": true,
        "norms": {
          "enabled": false
        }
      },
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "not_analyzed",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "string",
          "index": "analyzed"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip"  : {
          "type" : "object",
          "dynamic": true,
          "properties" : {
            "location" : { "type" : "geo_point" }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

{
  "mappings": {
    "_default_": {
      "dynamic_templates": [
        {
          "template1": {
            "mapping": {
              "doc_values": true,
              "ignore_above": 1024,
              "index": "false",
              "type": "{dynamic_type}"
            },
            "match": "*"
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "text",
          "index": "true"
        },
        "offset": {
          "type": "long",
          "doc_values": "true"
        },
        "geoip": {
          "type": "object",
          "dynamic": true,
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        }
      }
    }
  },
  "settings": {
    "index.refresh_interval": "5s"
  },
  "template": "filebeat-*"
}

基本上，我将消息类型从string更改为text。同样，从elastic 6.0开始，索引字段使用真或假，而不是分析

运行此命令后（如上文中所述）：

我设法从elastic获得了正确的确认：

{ 
  "acknowledged" : true
}

我还没有测试过，但请让我知道它是否适合你

---

您可能会注意到，\u all模板也从原始json中删除。为什么？显然是这样的，有很多方法可以使用复制到而不是中所建议的，但我还没有弄明白。

在生成模板时，您应该能够使用

-es.version 6.2.4

，让它为您的elasticsearch版本输出适当的映射

请查看有关的说明。它们显示了下面的windows示例，但它也可以在linux中工作

PS > .\filebeat.exe export template --es.version 6.6.2 | Out-File -Encoding UTF8 filebeat.template.json

---

你正在运行哪个版本的filebeat？@Val，我已经在更新的帖子中为你的问题添加了答案。酷，很高兴你找到了答案！