elasticsearch 更新映射冲突异常

Question

我有一个名为“myproject-error-2016-08”的索引，它只有一种名为“error”的类型。

当我打：

GET myproject-error-2016-08/_mapping

它返回以下结果：

{
   "myproject-error-2016-08": {
      "mappings": {
         "error": {
            "properties": {
               ...
               "responseCode": {
                  "type": "string"
               },
               ...
            }
         }
      }
   }
}

我需要将 responseCode 更新为 not_analyzed，因此我使用以下 reuest ：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "index": "not_analyzed"
      }
   }
}

并获得以下异常：

{
   "error": {
      "root_cause": [
         {
            "type": "illegal_argument_exception",
            "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
         }
      ],
      "type": "illegal_argument_exception",
      "reason": "Mapper for [responseCode] conflicts with existing mapping in other types:\n[mapper [responseCode] has different [index] values, mapper [responseCode] has different [doc_values] values, cannot change from disabled to enabled, mapper [responseCode] has different [analyzer]]"
   },
   "status": 400
}

我也试过以下：

PUT myproject-error-2016-08/_mapping/error?update_all_types
{
...
}

但它返回了相同的响应。

弹性搜索是：

$ ./elasticsearch -version
Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_91

Answer 1

您不能更改类型一旦它被创建的领域。

但是，您绝对可以创建这样的not_analyzed子字段：

PUT myproject-error-2016-08/_mapping/error
{
   "properties": {
      "responseCode": {
         "type": "string",
         "fields": {
            "raw": {
               "type": "string",
               "index": "not_analyzed"
            }
         }
      }
   }
}

然后您需要重新索引您的数据/日志以填充该子字段，并且您将能够responseCode.raw在您的查询中引用。