elasticsearch更新映射冲突异常

Question

我有一个名为“myproject-error-2016-08”的索引，它只有一种名为“error”的类型。

当我击球时：

GET myproject-error-2016-08/_mapping

它返回以下结果：

{
   "myproject-error-2016-08": {
      "mappings": {
         "error": {
            "properties": {
               ...
               "responseCode": {
                  "type": "string"
               },
               ...
            }
         }
      }
   }
}

我需要将 responseCode 更新为 not_analyzed， 因此我使用以下请求：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "index": "not_analyzed"
      }
   }
}

并得到以下异常：

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
   },
   "status": 400
}

我也尝试了以下方法：

PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}

但它返回了相同的响应。

弹性搜索是：

$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91

Answer 1

字段创建后的cannot change the type。

但是，您绝对可以像这样创建not_analyzed 子字段：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

然后您需要re-index your data/logs 来填充该子字段，并且您可以在查询中引用responseCode.raw。

更新：由于 ES5 not_analyzed string 不再存在，现在称为keyword：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "text",
         "fields": {
            "raw": {
               "type": "keyword"
            }
         }
      }
   }
}