我需要帮助来纠正 kibana 字段。当我尝试可视化这些字段时,向我显示了以下警告:
Careful! The field contains Analyzed selected strings. Analyzed strings are highly unique and can use a lot of memory to visualize. Values: such as bar will be foo-foo and bar broken into. See Core Mapping Types for more information on setting esta field Analyzed as not
最佳答案
Elasticsearch默认动态映射是分析任意字符串字段(将字段分解为token,例如:aaa_bbb_ccc会分解为aaa、bbb和ccc)。
如果您不希望出现这种行为,则必须更改映射设置
在任何文档被插入索引 之前.
您有两种选择:
此示例显示了一个模板,该模板更改了以“app”开头的任何索引的映射,将“不分析”应用于任何类型的任何字段并确保“时间戳”是日期(适用于时间戳表示为的情况)从 1970 年开始的秒数):
{
"template": "myindciesprefix*",
"mappings": {
"_default_": {
"dynamic_templates": [
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"type": "string",
"index": "not_analyzed"
}
}
},
{
"timestamp_field": {
"match": "timestamp",
"mapping": {
"type": "date"
}
}
}
]
}
}
}
关于elasticsearch - Kibana 上未分析的字段,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/34298034/