elasticsearch mapper_parsing_exception 根映射定义具有不受支持的参数

Question

在尝试创建模板时，我在使用 elasticsearch 7 时遇到以下问题。

当我尝试将模板从 elasticsearch 6 复制到 7 以及根据 elasticsearch 7 .e 删除的一些字段时

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Root mapping definition has unsupported parameters:  [events : {properties={msg={fields={raw={type=keyword}}}, requestId={type=keyword}, logger={type=keyword}, host={type=keyword}, jwtOwner={type=keyword}, requestOriginator={type=keyword}, tag={analyzer=firsttoken, fields={disambiguator={analyzer=keyword, type=text}}}, jwtAuthenticatedUser={type=keyword}, thread={type=keyword}, requestChainOriginator={type=keyword}, revision={type=keyword}}}]"
    }
  },
  "status": 400
}

映射模板：以下是我要发布的模板。

POST _template/logstash
{
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "mapper" : {

        }
      }
    },
    "mappings" : {
      "events" : {
        "properties" : {
          "msg" : {
            "type" : "text",
            "fields" : {
              "raw" : {
                "type" : "keyword"
              }
            }
          },
          "requestId" : {
            "type" : "keyword"
          },
          "logger" : {
            "type" : "keyword"
          },
          "host" : {
            "type" : "keyword"
          },
          "jwtOwner" : {
            "type" : "keyword"
          },
          "requestOriginator" : {
            "type" : "keyword"
          },
          "tag" : {
            "analyzer" : "firsttoken",
            "fields" : {
              "disambiguator" : {
                "analyzer" : "keyword",
                "type" : "text"
              }
            }
          },
          "jwtAuthenticatedUser" : {
            "type" : "keyword"
          },
          "thread" : {
            "type" : "keyword"
          },
          "requestChainOriginator" : {
            "type" : "keyword"
          },
          "revision" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  }

请帮我解决问题。提前致谢。

Answer 1

有两个问题。一个问题是@OpsterESNinjaKamal 提到的问题

但由于tag 字段没有类型，它仍然不起作用。

下面是可以使用的模板：

PUT _template/logstash
{
  "order": 0,
  "index_patterns": [
    "logstash*"
  ],
  "settings": {
    "index": {
      "analysis": {
        "filter": {
          "firsttoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^([^\\.]*)\\.?.*$"
            ]
          },
          "secondtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          },
          "thirdtoken": {
            "type": "pattern_capture",
            "preserve_original": "false",
            "patterns": [
              "^[^\\.]*\\.[^\\.]*\\.([^\\.]*)\\.?.*$"
            ]
          }
        },
        "analyzer": {
          "firsttoken": {
            "filter": [
              "firsttoken"
            ],
            "tokenizer": "keyword"
          },
          "secondtoken": {
            "filter": [
              "secondtoken"
            ],
            "tokenizer": "keyword"
          },
          "thirdtoken": {
            "filter": [
              "thirdtoken"
            ],
            "tokenizer": "keyword"
          }
        }
      },
      "mapper": {}
    }
  },
  "mappings": {
    "properties": {
      "msg": {
        "type": "text",
        "fields": {
          "raw": {
            "type": "keyword"
          }
        }
      },
      "requestId": {
        "type": "keyword"
      },
      "logger": {
        "type": "keyword"
      },
      "host": {
        "type": "keyword"
      },
      "jwtOwner": {
        "type": "keyword"
      },
      "requestOriginator": {
        "type": "keyword"
      },
      "tag": {
        "type": "text",                    <--- add type here
        "analyzer": "firsttoken",
        "fields": {
          "disambiguator": {
            "analyzer": "keyword",
            "type": "text"
          }
        }
      },
      "jwtAuthenticatedUser": {
        "type": "keyword"
      },
      "thread": {
        "type": "keyword"
      },
      "requestChainOriginator": {
        "type": "keyword"
      },
      "revision": {
        "type": "keyword"
      }
    }
  },
  "aliases": {}
}

Answer 2

请注意您的mappings。 ES post version 7.0，在这种情况下不支持type，即events，即deprecated。

发布 7.0 版后，您需要为 7.0 版之前的索引中的每个 type 创建一个单独的索引。

这个link 应该可以帮助您了解如何从版本 6.x 迁移到 7.x

基本上你的mappings 部分如下：

{
   "mappings":{
      "properties":{                     <---- Notice there is no `events` before `properties` as mentioned in your question
         "msg":{
            "type":"text",
            "fields":{
               "raw":{
                  "type":"keyword"
               }
            }
         },
         "requestId":{
            "type":"keyword"
         },
         "logger":{
            "type":"keyword"
         },
         "host":{
            "type":"keyword"
         },
         "jwtOwner":{
            "type":"keyword"
         },
         "requestOriginator":{
            "type":"keyword"
         },
         "tag":{
            "analyzer":"firsttoken",
            "fields":{
               "disambiguator":{
                  "analyzer":"keyword",
                  "type":"text"
               }
            }
         },
         "jwtAuthenticatedUser":{
            "type":"keyword"
         },
         "thread":{
            "type":"keyword"
         },
         "requestChainOriginator":{
            "type":"keyword"
         },
         "revision":{
            "type":"keyword"
         }
      }
   }
}

Answer 3

抱歉，Vol 和 Opster 我错过了添加事件模板。我删除了该事件，因为它不接受。以下是活动模板。

PUT  _template/logstash
{
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "mapper" : {

        }
      }
    },
    "mappings" : {
      "events" : {
        "properties" : {
          "msg" : {
            "type" : "text",
            "fields" : {
              "raw" : {
                "type" : "keyword"
              }
            }
          },
          "requestId" : {
            "type" : "keyword"
          },
          "logger" : {
            "type" : "keyword"
          },
          "host" : {
            "type" : "keyword"
          },
          "jwtOwner" : {
            "type" : "keyword"
          },
          "requestOriginator" : {
            "type" : "keyword"
          },
          "tag" : {
            "analyzer" : "firsttoken",
            "fields" : {
              "disambiguator" : {
                "analyzer" : "keyword",
                "type" : "text"
              }
            },
            "type" : "text"
          },
          "jwtAuthenticatedUser" : {
            "type" : "keyword"
          },
          "thread" : {
            "type" : "keyword"
          },
          "requestChainOriginator" : {
            "type" : "keyword"
          },
          "revision" : {
            "type" : "keyword"
          }
        }
      }
    },
    "aliases" : { }
  }