ElasticSearch字段前缀为"@"

Question

我看到很多例子映射域看起来像@timestamp,@name等等.

这是什么意思？它是否有任何改变或是一些惯例？谷歌很棘手,我没有找到任何阅读文档的参考资料.

这是一个例子:https://gist.github.com/deverton/2970285

        ...
        "properties" : {
            "@fields": { "type": "object", "dynamic": true, "path": "full" }, 
            "@message" : { "type" : "string", "index" : "analyzed" },
            "@source" : { "type" : "string", "index" : "not_analyzed" },
            "@source_host" : { "type" : "string", "index" : "not_analyzed" },
            "@source_path" : { "type" : "string", "index" : "not_analyzed" },
            "@tags": { "type": "string", "index" : "not_analyzed" }, 
            "@timestamp" : { "type" : "date", "index" : "not_analyzed" },
            "@type" : { "type" : "string", "index" : "not_analyzed" }
        }
        ...

Answer 1

这些设置不会影响任何事情.它们是标准化的logstash字段,可用于轻松报告源自多个源的日志.

它们只是一个logstash约定而不是弹性搜索约定.