elasticsearch 为什么在设置映射后，索引什么也不返回？

我在Windows10x64上使用Elasticsearch 7.12.0、Logstash 7.12.0、Kibana 7.12.0。日志存储配置文件

logistics.conf

input {
  jdbc {
    jdbc_driver_library => "D:\\tools\\postgresql-42.2.16.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://localhost:5433/ld"
    jdbc_user => "xxxx"
    jdbc_password => "sEcrET"
    schedule => "*/5 * * * *"
    statement => "select * from inventory_item_report();"
    }
}

filter {
  uuid {
    target => "uuid"
  }
}

output {
  elasticsearch {
    hosts => "http://localhost:9200"
    index => "localdist"
    document_id => "%{uuid}"
    doc_as_upsert => "true"
    }
}

跑马场

logstash -f logistics.conf

如果不显式设置映射，则查询

GET /localdist/_search
{
  "query": {
    "match_all": {}
  }
}

返回许多结果

我的映射

POST localdist/_mapping
{
  
}

DELETE /localdist

PUT /localdist
{
  
}

POST /localdist
{
  
}

PUT localdist/_mapping
{
  "properties": {
    "unt_cost": {
      "type": "double"
    },
    "ii_typ": {
      "type": "keyword"
    },
    "qty_uom_id": {
      "type": "keyword"
    },
    "prod_id": {
      "type": "keyword"
    },
    "root_cat_id": {
      "type": "keyword"
    },
    "uom": {
      "type": "keyword"
    },
    "product_name": {
      "type": "text"
    },
    "ii_id": {
      "type": "keyword"
    },
    "wght_uom_id": {
      "type": "keyword"
    },
    "iid_seq_id": {
      "type": "long"
    },
    "avai_diff": {
      "type": "double"
    },
    "invt_change_typ": {
      "type": "keyword"
    },
    "ccy": {
      "type": "keyword"
    },
    "exp_date": {
      "type": "date"
    },
    "req_amt": {
      "type": "text"
    },
    "pur_cost": {
      "type": "double"
    },
    "tot_pri": {
      "type": "long"
    },
    "own_pid": {
      "type": "keyword"
    },
    "doc_type": {
      "type": "keyword"
    },
    "ii_date": {
      "type": "date"
    },
    "fac_id": {
      "type": "keyword"
    },
    "shipment_type_id": {
      "type": "keyword"
    },
    "lot_id": {
      "type": "keyword"
    },
    "phy_invt_id": {
      "type": "keyword"
    },
    "facility_name": {
      "type": "text"
    },
    "amt_ohand_diff": {
      "type": "double"
    },
    "reason_id": {
      "type": "keyword"
    },
    "cat_id": {
      "type": "keyword"
    },
    "qty_ohand_diff": {
      "type": "double"
    },
    "@timestamp": {
      "type": "date"
    }
  }
}

运行查询

GET /localdist/_search
{
  "query": {
    "match_all": {}
  }
}

一无所获

---

如何修复它，如何使显式映射正确工作？

如果我没弄错，您正在通过logstash进行索引。Elastic然后创建索引（如果缺少），为文档编制索引，并尝试根据第一个文档猜测文档的映射

TL；DR：您正在删除包含数据的索引

与

您正在删除包含所有数据的整个索引。之后，通过发行

PUT /localdist
{
  
}

您正在重新创建以前删除的索引，该索引再次为空。最后，您将使用设置索引映射

PUT localdist/_mapping
{
  "properties": {
    "unt_cost": {
      "type": "double"
    },
    "ii_typ": {
      "type": "keyword"
    },
    ...

---

现在，由于有一个带有映射集的空弹性索引，请再次启动logstash管道。如果您的文档与索引映射相匹配，文档应该会很快开始显示。

映射后有什么作用？我使用Logstash JDBC将索引放入Elasticsearch。如果Logstash管道有15个字段，我会显式声明映射为5个字段，其他10个字段会发生什么情况，请告诉我这种情况下的行为。如果字段映射尚未定义，elastic将根据字段值尝试“有根据的猜测”：它解决了您的问题吗？它不起作用。错误消息是什么？

PUT localdist/_mapping
{
  "properties": {
    "unt_cost": {
      "type": "double"
    },
    "ii_typ": {
      "type": "keyword"
    },
    ...