弹性搜索未使用来自logstash的定义模板进行映射

Question

我有以下 logstash 输出配置可以从 postgres 数据库进入 elasticsearch

https://pastebin.com/BFCH3tuZ

我已将位置和模板定义如下：

https://pastebin.com/mK5qshKM

当我运行 logstash 时，我看到的输出如下：

[2017-05-24T20:54:10,828][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://localhost:9200/, :path=>"/"}
[2017-05-24T20:54:10,982][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>#<URI::HTTP:0xff97ab URL:http://localhost:9200/>}
[2017-05-24T20:54:10,985][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>"/etc/logstash/universe_template.json"}
[2017-05-24T20:54:11,045][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"universe_elastic", "settings"=>{"analysis"=>{"filter"=>{"gr$
[2017-05-24T20:54:11,052][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/universe_elastic
[2017-05-24T20:54:11,145][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>[#<URI::Generic:0xe60519 URL://localhost:9200$
[2017-05-24T20:54:11,154][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inf$
[2017-05-24T20:54:11,988][INFO ][logstash.pipeline        ] Pipeline main started
[2017-05-24T20:54:12,079][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2017-05-24T20:54:12,108][INFO ][logstash.inputs.jdbc     ] (0.101000s) select planet.id, planet.x || ':' || planet.y || ':' || planet.z coords, planet.x, planet.y, planet.z ,planetname,ru$
[2017-05-24T20:54:15,006][WARN ][logstash.agent           ] stopping pipeline {:id=>"main"}

当我查询 elasticseach 模板时，我可以看到我的模板列在：

http://xxxx:9200/_template/ {   "universe_elastic": {
    "order": 0,
    "template": "universe_elastic",
    "settings": {
      "index": {
        "analysis": {
          "filter": {
            "gramFilter": {
              "token_chars": [
                "letter",
                "digit",
                "punctuation",
                "symbol"
              ], ETC ETC ETC......

但是，当我检查我的“宇宙”索引时，映射并没有通过：

https://pastebin.com/hw9hYfLn

我希望看到 _all 字段和包含在所有引用中设置为真/假。但什么都没有.. 查询也不使用我指定的分析器。

您知道这里可能出了什么问题吗？我已经删除了所有其他可能创建的模板以及重新创建的索引等。

Answer 1

你几乎都做对了，你只需要改变一件事情：

在你的模板中，这一行

  "template": "universe_elastic",

应该阅读

  "template": "universe",

只有当您的索引名称与模板名称匹配时，ES 才会应用 apply。