elasticsearch映射解析器异常答案

【问题标题】：elasticsearch mapping parser exceptionelasticsearch映射解析器异常
【发布时间】：2021-11-04 12:59:17
【问题描述】：

我正在尝试将 Jmeter 测试报告导入 ELK 堆栈（ElasticSearch、Logstash、Kibana）。

我正在使用：

ElasticSearch 6.7.1 版
Logstash 版本 6.7.1
Kibana 版本 6.7.1

我正在将此 .csv 提供给 Logstash 并将此数据导入到 elasticsearch

Label,SampleSize,Average,Median,90% Line,95% Line,99% Line,Min,Max,Error %,Throughput,Received KB/sec,Std Deviation,targethost
myRequest,5,59,58,63,66,66,52,66,0.00%,5.8,12.3,4.87,myHost

为了更清楚，这里有一个表格格式

Label	SampleSize	Average	Median	90% Line	95% Line	99% Line	Min	Max	Error %	Throughput	Received KB/sec	Std Deviation	targethost
myRequest	5	59	58	63	66	66	52	66	0.00%	5.8	12.3	4.87	myHost

我在 ElasticSearch 中创建了这个映射：

PUT jmeter-report
{
  "settings": {
    "number_of_shards": 5
  },
  "mappings": {
    "doc": {
      "properties": {
        "90% Line": {
          "type": "long"
        },
        "95% Line": {
          "type": "long"
        },
        "99% Line": {
          "type": "long"
        },
        "Max": {
          "type": "long"
        },
        "Median": {
          "type": "long"
        },
        "Min": {
          "type": "long"
        },
        "Received KB/sec": {
          "type": "double"
        },
        "SampleSize": {
          "type": "long"
        },
        "Std Deviation": {
          "type": "double"
        },
        "Error %": {
          "type": "double"
        },
        "Average": {
          "type": "long"
        },
        "Throughput": {
          "type": "double"
        }
      }
    }
  }
}

但我在 Logstash 日志中收到以下错误消息：

[WARN][logstash.outputs.elasticsearch] 无法将事件索引到 Elasticsearch。 {:status=>400, :action=>["index", {:_id=>nil, :_index=>"jmeter-report", :_type=>"doc", :routing=>nil}, #LogStash ::Event:0x3a7561c3], :response=>{"index"=>{"_index"=>"jmeter-report", "_type"=>"doc", "_id"=>"qEXlwHsBSxy0UyVRzKMJ", "status" =>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"无法解析文档中类型为 [long] 的字段 [99% Line]，id 为 'qEXlwHsBSxy0UyVRzKMJ'", "caused_by "=>{"type"=>"illegal_argument_exception", "reason"=>"对于输入字符串："99% Line""}}}}}

如果我停止并重新启动 Logstash，错误消息中的字段（此处为“99% 行”）将不一样，它似乎有点随机

【问题讨论】：

标签： elasticsearch jmeter logstash

【解决方案1】：

"reason"=>"对于输入字符串："99% Line"

它无法索引标题行，因为它无法将标题解析为 longs。

您可以忽略它，因为索引标头不会增加任何价值，或者您可以将其放在 logstash 中

if [message] =~ /99% Line/ { drop {} }

【讨论】：