重新绘制弹性搜索

Question

logstash config我已经在elasticsearch和kibana上创建了我的索引并且已经上传了数据.现在我想更改索引的映射并将某些字段更改为未分析.Below是我想要从现有映射替换的映射.但是当我在命令下运行它会给我错误

{"error":{"root_cause":[{"type":"index_already_exists_exception","reason":"已存在","index":"rettrmt"}],"type":"index_already_exists_exception","reason" :"已存在","索引":"rettrmt"},"状态":400}

请帮忙把它关闭.

curl -XPUT 'http://10.56.139.61:9200/rettrmt' -d '{
  "rettrmt": {
    "aliases": {},
    "mappings": {
      "RETTRMT": {
        "properties": {
          "@timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "@version": {
            "type": "string"
          },
          "acid": {
            "type": "string"
          },
          "actor_id": {
            "type": "string",
            "index": "not_analyzed"
          },
          "actor_type": {
            "type": "string",
            "index": "not_analyzed"
          },
          "channel_id": {
            "type": "string",
            "index": "not_analyzed"
          },
          "circle": {
            "type": "string",
            "index": "not_analyzed"
          },
          "cr_dr_indicator": {
            "type": "string",
            "index": "not_analyzed"
          },
          "host": {
            "type": "string"
          },
          "message": {
            "type": "string"
          },
          "orig_input_amt": {
            "type": "double"
          },
          "path": {
            "type": "string"
          },
          "r_cre_id": {
            "type": "string"
          },
          "sub_use_case": {
            "type": "string",
            "index": "not_analyzed"
          },
          "tran_amt": {
            "type": "double"
          },
          "tran_id": {
            "type": "string"
          },
          "tran_particulars": {
            "type": "string"
          },
          "tran_particulars_2": {
            "type": "string"
          },
          "tran_remarks": {
            "type": "string"
          },
          "tran_sub_type": {
            "type": "string"
          },
          "tran_timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "tran_type": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "use_case": {
            "type": "string",
            "index": "not_analyzed"
          }
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "1457331693603",
        "uuid": "2bR0yOQtSqqVUb8lVE2dUA",
        "number_of_replicas": "1",
        "number_of_shards": "5",
        "version": {
          "created": "2000099"
        }
      }
    },
    "warmers": {}
  }
}'

Answer 1

首先需要删除索引,然后使用正确的映射重新创建它.在这里你得到一个错误,index_already_exists_exception因为你试图创建一个索引,而较旧的索引仍然存在,因此冲突.

首先运行:

curl -XDELETE 'http://10.56.139.61:9200/rettrmt'

然后你可以再次运行你的命令.请注意,这将删除您的数据,因此您必须重新填充索引.