elasticsearch - (kibana)mapper_parsing_exception

标签 elasticsearch kibana elastic-stack

我正在尝试为此类日志设置映射(自动映射不起作用)。

这是我要分析的日志，感谢 kibana(在互联网上找到):

{"index":
    {"_index":"logstash-2015.05.18","_type":"log"
    }
}
{"@timestamp":"2015-05-18T09:03:25.877Z","ip":"185.124.182.126","extension":"gif","response":"404",
    "geo":{
        "coordinates":{
            "lat":36.518375,"lon":-86.05828083
        },
    "src":"PH","dest":"MM","srcdest":"PH:MM"
    },
    "@tags":["success","info"],"utc_time":"2015-05-18T09:03:25.877Z","referer":"http://twitter.com/error/william-shepherd","agent":"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1","clientip":"185.124.182.126","bytes":804,"host":"motion-media.theacademyofperformingartsandscience.org","request":"/canhaz/gemini-7.gif","url":"https://motion-media.theacademyofperformingartsandscience.org/canhaz/gemini-7.gif","@message":"185.124.182.126 - - [2015-05-18T09:03:25.877Z] \"GET /canhaz/gemini-7.gif HTTP/1.1\" 404 804 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\"","spaces":"this   is   a   thing    with lots of     spaces       wwwwoooooo","xss":"<script>console.log(\"xss\")</script>","headings":["<h3>f-i-j-nl-ng</h5>","http://facebook.com/success/lodewijk-van-den-berg"],"links":["<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f591949b9c9099d881949b9cb593949690979a9a9edb969a98" rel="noreferrer noopener nofollow">[email protected]</a>","http://nytimes.com/security/kathryn-sullivan","www.nytimes.com"],
    "relatedContent":[
        {"url":"http://www.laweekly.com/news/cbs-crew-rat-fink-2368032","og:type":"article","og:title":"CBS Crew Rat Fink","og:description":"Near a couple of auto body shops (and a sharp new Space Invader mosaic that we&#039;ll post soon) near Temple and Westmoreland is a CBS wall with a nice Rat ...","og:url":"http://www.laweekly.com/news/cbs-crew-rat-fink-2368032","article:published_time":"2008-01-14T08:05:26-08:00","article:modified_time":"2014-10-28T14:59:52-07:00","article:section":"News","article:tag":"Mark Mauer","og:image":"http://IMAGES1.laweekly.com/imager/cbs-crew-rat-fink/u/original/2430299/img_2049.jpg","og:image:height":"360","og:image:width":"480","og:site_name":"LA Weekly","twitter:title":"CBS Crew Rat Fink","twitter:description":"Near a couple of auto body shops (and a sharp new Space Invader mosaic that we&#039;ll post soon) near Temple and Westmoreland is a CBS wall with a nice Rat ...","twitter:card":"summary","twitter:image":"http://IMAGES1.laweekly.com/imager/cbs-crew-rat-fink/u/original/2430299/img_2049.jpg","twitter:site":"@laweekly"
        },
        {"url":"http://www.laweekly.com/news/push-and-retna-in-koreatown-2368043","og:type":"article","og:title":"Push and Retna in Koreatown","og:description":"Yeah, I originally had this posted this morning as Push &amp; Ayer - Sorry. It looked like a Retna piece, but I saw the Ayer in there and thought that must ...","og:url":"http://www.laweekly.com/news/push-and-retna-in-koreatown-2368043","article:published_time":"2008-01-29T07:28:32-08:00","article:modified_time":"2014-10-28T14:59:54-07:00","article:section":"News","article:tag":"Shelley Leopold","og:image":"http://IMAGES1.laweekly.com/imager/push-and-retna-in-koreatown/u/original/2430376/img_3671.jpg","og:image:height":"360","og:image:width":"480","og:site_name":"LA Weekly","twitter:title":"Push and Retna in Koreatown","twitter:description":"Yeah, I originally had this posted this morning as Push &amp; Ayer - Sorry. It looked like a Retna piece, but I saw the Ayer in there and thought that must ...","twitter:card":"summary","twitter:image":"http://IMAGES1.laweekly.com/imager/push-and-retna-in-koreatown/u/original/2430376/img_3671.jpg","twitter:site":"@laweekly"
        },
        {"url":"http://www.laweekly.com/news/asylm-ruets-pdb-on-santa-monica-2368012","og:type":"article","og:title":"Asylm, Ruets, PDB on Santa Monica","og:description":"Not a new piece, but a well-hidden gem a little south of Santa Monica Blvd. in an alley off of Heliotrope or Edgemont. I&#039;ve been sitting on this for a w...","og:url":"http://www.laweekly.com/news/asylm-ruets-pdb-on-santa-monica-2368012","article:published_time":"2008-04-22T15:11:15-07:00","article:modified_time":"2014-10-28T14:59:48-07:00","article:section":"News","article:tag":"Culture and Lifestyle","og:image":"http://images1.laweekly.com/imager/asylm-ruets-pdb-on-santa-monica/u/original/2430137/img_5027.jpg","og:image:height":"360","og:image:width":"480","og:site_name":"LA Weekly","twitter:title":"Asylm, Ruets, PDB on Santa Monica","twitter:description":"Not a new piece, but a well-hidden gem a little south of Santa Monica Blvd. in an alley off of Heliotrope or Edgemont. I&#039;ve been sitting on this for a w...","twitter:card":"summary","twitter:image":"http://images1.laweekly.com/imager/asylm-ruets-pdb-on-santa-monica/u/original/2430137/img_5027.jpg","twitter:site":"@laweekly"
        },
        {"url":"http://www.laweekly.com/news/laurence-tribe-tangles-with-cbs-and-la-city-hall-2396867","og:type":"article","og:title":"Laurence Tribe Tangles with CBS and L.A. City Hall","og:description":"The United States Court of Appeals for the Ninth Circuit&rsquo;s Courtroom 3 - a miniature auditorium with comfortable, smoked salmon-colored seats - wa...","og:url":"http://www.laweekly.com/news/laurence-tribe-tangles-with-cbs-and-la-city-hall-2396867","article:published_time":"2008-06-04T14:16:10-07:00","article:modified_time":"2014-11-26T14:43:59-08:00","article:section":"News","og:site_name":"LA Weekly","twitter:title":"Laurence Tribe Tangles with CBS and L.A. City Hall","twitter:description":"The United States Court of Appeals for the Ninth Circuit&rsquo;s Courtroom 3 - a miniature auditorium with comfortable, smoked salmon-colored seats - wa...","twitter:card":"summary","twitter:site":"@laweekly"
        }
    ],
    "machine":{
        "os":"win xp","ram":3221225472
    },
    "@version":"1"
}

这是我放入 Kibana 开发工具中的映射:

PUT logstash-2019.05.09
{
  "mappings": {
    "doc": {
      "properties": {
        "index": {
          "_index": {
            "type": "keyword"
          },
          "_type": {
            "type": "text"
          }
        },
        "@timestamp": {
          "type": "date"
        },
        "ip": {
          "type": "ip"
        },
        "extension": {
          "type": "text"
        },
        "response": {
          "type": "text"
        },
        "geo": {
          "coordinates": {
            "type": "geo_point"
          },
          "src": {
            "type": "text"
          },
          "dest": {
            "type": "text"
          },
          "srcdest": {
            "type": "text"
          }
        },
        "tags": {
          "type": "text"
        },
        "utc_time": {
          "type": "date"
        },
        "referer": {
          "type": "text"
        },
        "agent": {
          "type": "text"
        },
        "clientip": {
          "type": "ip"
        },
        "bytes": {
          "type": "integer"
        },
        "host": {
          "type": "text"
        },
        "request": {
          "type": "text"
        },
        "url": {
          "type": "text"
        },
        "@message": {
          "type": "text"
        },
        "spaces": {
          "type": "text"
        },
        "xss": {
          "type": "text"
        },
        "links": {
          "type": "text"
        },
        "relatedContent": {
          "url": {
            "type": "text"
          },
          "og:type": {
            "type": "text"
          },
          "og:title": {
            "type": "text"
          },
          "og:description": {
            "type": ""
          },
          "og:url": {
            "type": ""
          },
          "article:published_time": {
            "type": "date"
          },
          "article:modified_time": {
            "type": "date"
          },
          "article:section": {
            "type": "keyword"
          },
          "article:tag": {
            "type": "text"
          },
          "og:image": {
            "type": "text"
          },
          "og:image:height": {
            "type": "integer"
          },
          "og:image:width": {
            "type": "integer"
          },
          "og:site_name": {
            "type": "text"
          },
          "twitter:title": {
            "type": "text"
          },
          "twitter:description": {
            "type": "text"
          },
          "twitter:card": {
            "type": "keyword"
          },
          "twitter:image": {
            "type": "text"
          },
          "twitter:site": {
            "type": "keyword"
          }
        },
        "machine": {
          "os": {
            "type": "text"
          },
          "ram": {
            "type": "integer"
          }
        },
        "@version": {
          "type": "integer"
        }
      }
    }
  }
}

这是错误:

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "No type specified for field [index]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [doc]: No type specified for field [index]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "No type specified for field [index]"
    }
  },
  "status": 400
}

我已经在互联网上搜索了一些解决方案，但没有找到任何可以帮助我的内容。

最佳答案

您的所有 object 字段都缺少 properties 关键字。请改用此映射

PUT logstash-2019.05.09
{
  "mappings": {
    "doc": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "ip": {
          "type": "ip"
        },
        "extension": {
          "type": "text"
        },
        "response": {
          "type": "text"
        },
        "geo": {
          "properties": {
            "coordinates": {
              "type": "geo_point"
            },
            "src": {
              "type": "text"
            },
            "dest": {
              "type": "text"
            },
            "srcdest": {
              "type": "text"
            }
          }
        },
        "tags": {
          "type": "text"
        },
        "utc_time": {
          "type": "date"
        },
        "referer": {
          "type": "text"
        },
        "agent": {
          "type": "text"
        },
        "clientip": {
          "type": "ip"
        },
        "bytes": {
          "type": "integer"
        },
        "host": {
          "type": "text"
        },
        "request": {
          "type": "text"
        },
        "url": {
          "type": "text"
        },
        "@message": {
          "type": "text"
        },
        "spaces": {
          "type": "text"
        },
        "xss": {
          "type": "text"
        },
        "links": {
          "type": "text"
        },
        "relatedContent": {
          "properties": {
            "url": {
              "type": "text"
            },
            "og:type": {
              "type": "text"
            },
            "og:title": {
              "type": "text"
            },
            "og:description": {
              "type": ""
            },
            "og:url": {
              "type": ""
            },
            "article:published_time": {
              "type": "date"
            },
            "article:modified_time": {
              "type": "date"
            },
            "article:section": {
              "type": "keyword"
            },
            "article:tag": {
              "type": "text"
            },
            "og:image": {
              "type": "text"
            },
            "og:image:height": {
              "type": "integer"
            },
            "og:image:width": {
              "type": "integer"
            },
            "og:site_name": {
              "type": "text"
            },
            "twitter:title": {
              "type": "text"
            },
            "twitter:description": {
              "type": "text"
            },
            "twitter:card": {
              "type": "keyword"
            },
            "twitter:image": {
              "type": "text"
            },
            "twitter:site": {
              "type": "keyword"
            }
          }
        },
        "machine": {
          "properties": {
            "os": {
              "type": "text"
            },
            "ram": {
              "type": "integer"
            }
          }
        },
        "@version": {
          "type": "integer"
        }
      }
    }
  }
}

关于elasticsearch - (kibana)mapper_parsing_exception，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/56055538/

上一篇：elasticsearch - 使用 _id 更新文档elasticsearch

下一篇：arrays - 不能将成员添加为同名成员存在

相关文章：

string - Elasticsearch一开始不能使用斜杠

c# - Elastic Search提取附件插件 block

java - Elasticsearch(6.5) 高级 Java Rest 客户端按名称删除索引不起作用

elasticsearch - 在Elasticsearch中操纵分数

elasticsearch - 对未索引字段的elasticsearch更新操作

elasticsearch - “inverted index are immutable in elastic search”到底是什么意思？

elasticsearch - 如何使用Logstash和grok插件创建字段

elasticsearch - ELK和LDAP之间的集成

elasticsearch - 如何在kibana中的字段上启用排序？

elasticsearch - logstash元数据未传递给elasticsearch

©2024 IT工具网  联系我们