Json elasticsearch 6.2与bulk_api的映射

我在尝试将数据插入elasticsearch时遇到问题。 我有1000个json文件，我想使用批量API使用

curl

对所有文件进行迭代

我的json文件如下所示：

{"index": {"_index": "stuff", "_type": "text", "_id": "1"}}{"lastversion":"2018-01-19","attribution":[],"description":"","notes":[],"alt_names":[],"sources":[],"urls":["https://www.fireeye.com/blog/threat-research/2018/01/microsoft-office-vulnerabilities-used-to-distribute-zyklon-malware.html"],"common_name":"anonym","samples":[{"status":"dumped","sha256":"8d0be4dd8b0ca7608bf3a02a2d212ce845ac733d150b4428376a5a939f1679ec","version":""}]}

我所做的是：

1。已创建名为“stuff”的索引。

curl-H'内容类型：application/json'-XPUT“localhost:9200/stuff/”；回声

2。创建映射（对于大多数json文件，因为我不知道如何为以下内容创建映射：

"samples": [
  {
    "status": "dumped",
    "sha256": "8d0be4dd8b0ca7608bf3a02a2d212ce845ac733d150b4428376a5a939f1679ec",
    "version": ""
  }
]

curl -H 'Content-Type: application/x-ndjson' -XPOST "localhost:9200/stuff/_bulk" --data-binary @our.json
{"took":5,"errors":true,"items":[{"index":{"_index":"stuff","_type":"text","_id":"1","status":400,"error":{"type":"mapper_parsing_exception","reason":"failed to parse, document is empty"}}}]}

我做了卷发：

curl -H 'Content-Type: application/json' -XPUT "localhost:9200/stuff" -d'
{
 "mappings": {
  "doc": {
   "properties": {
    "updated": {"type": "keyword"},
    "attribution": {"type": "keyword"},
    "description": {"type": "keyword"},
    "notes": {"type": "keyword"},
    "alt_names": {"type": "keyword"},
    "sources": {"type": "keyword"},
    "urls": {"type": "keyword"},
    "common_name": {"type": "keyword"}
   }
  }
 }
}
'

3.我已尝试使用curl上传到elasticsearch集群：

"samples": [
  {
    "status": "dumped",
    "sha256": "8d0be4dd8b0ca7608bf3a02a2d212ce845ac733d150b4428376a5a939f1679ec",
    "version": ""
  }
]

curl -H 'Content-Type: application/x-ndjson' -XPOST "localhost:9200/stuff/_bulk" --data-binary @our.json
{"took":5,"errors":true,"items":[{"index":{"_index":"stuff","_type":"text","_id":"1","status":400,"error":{"type":"mapper_parsing_exception","reason":"failed to parse, document is empty"}}}]}

我做错了什么？ 如何为提供的json正确创建映射？

---

我将非常感谢您对此的任何反馈。

首先，您正在创建一个名为

doc

的映射，并尝试使用以下内容索引数据：

{“index”：{“\u index”：“stuff”、“\u type”：“text”、“\u id”：“1”}}

这告诉ES下一个文档将是不存在的

\u type:text

的一部分，如果您使用ES>6.0，这将抛出一个错误，因为一个索引中不能有多个类型

另一方面，我猜您的

our.json

没有正确创建，您必须用

\n

分隔每个句子

那么您的示例将如下所示：

{"index": {"_index": "stuff", "_type": "text", "_id": "1"}}
{"lastversion":"2018-01-19","attribution":[],"description":"","notes":[],"alt_names":[],"sources":[],"urls":["https://www.fireeye.com/blog/threat-research/2018/01/microsoft-office-vulnerabilities-used-to-distribute-zyklon-malware.html"],"common_name":"anonym","samples":[{"status":"dumped","sha256":"8d0be4dd8b0ca7608bf3a02a2d212ce845ac733d150b4428376a5a939f1679ec","version":""}]}

---

您能否提供一个您试图通过

-data.bubart@our.json

发送的数据示例？数据位于“我的json文件看起来像：