elasticsearch更新映射冲突异常

Question

我有一个名为“myproject-error-2016-08”的索引，它只有一种名为“error”的类型。

当我点击 :

GET myproject-error-2016-08/_mapping

返回结果如下:

{
   "myproject-error-2016-08": {
      "mappings": {
         "error": {
            "properties": {
               ...
               "responseCode": {
                  "type": "string"
               },
               ...
            }
         }
      }
   }
}

我需要将 responseCode 更新为 not_analyzed， 因此我使用以下请求:

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "index": "not_analyzed"
      }
   }
}

并得到以下异常:

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
   },
   "status": 400
}

我也试过以下:

PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}

但它返回了相同的响应。

Elasticsearch 是:

$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91

Answer 1

你 cannot change the type一个字段一旦被创建。

但是，您绝对可以像这样创建一个 not_analyzed 子字段:

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

然后你需要re-index your data/logs为了填充该子字段，您将能够在查询中引用 responseCode.raw。

更新:由于 ES5 not_analyzed string 不再存在，现在称为 keyword:

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "text",
         "fields": {
            "raw": {
               "type": "keyword"
            }
         }
      }
   }
}