elasticsearch：无法解析类型[文本]的字段

Question

我在尝试插入带有对象的文档时收到此错误something：

failed to parse field [alert.something] of type [text]
in document with id 'S7wzjXwBoPDEI_MgkgFb'. Preview of field's value: '{a=b}'",

这是消息：

{
          "random" : 1634334912,
          "alert" : {
            "app_key" : "abc",
            "host" : "prod-mongo-1",
            "check" : "heap_size",
            "status" : "warning",
            "something": {
              "a": "b"
            }
          }
}

这是索引模板：

{
    "order" : 0,
    "index_patterns" : [
      "rawpayload-*"
    ],
    "settings" : {
      "index" : {
        "mapping" : {
          "coerce" : "false",
          "nested_fields" : {
            "limit" : "50"
          },
          "depth" : {
            "limit" : "20"
          },
          "ignore_malformed" : "false"
        }
      }
    },
    "mappings" : {
      "_source" : {
        "enabled" : true
      },
      "dynamic_templates": [
        {
          "alert_boject": {
            "path_match": "alert.*",
            "match_mapping_type" : "*",
            "mapping": {
              "type": "text"
            }
          }
        }
      ],
      "properties" : {
        "application" : {
          "index" : "false",
          "store" : true,
          "type" : "text"
        }
      }
    }
  }

您能指出或帮我解决这个问题吗:)？

Answer 1

作为alert.*是字符串或对象，为对象添加新的动态类型映射。

您当前的模板接受以下任何 JSON 类型alert_boject：

"match_mapping_type" : "*",

但仅映射到 JSON 字符串 - text- 这不适用于对象：

"mapping": {
  "type": "text"
}

修改当前模板以仅拾取text：

{
  "alert_boject": {
    "path_match": "alert.*",
    "match_mapping_type" : "text",
    "mapping": {
      "type": "text"
    }
  }
}

然后根据上述内容创建一个新模板 - 将映射类型 ( mapping.type) 更改为，object以便它接受对象并更改match_mapping_type为object。

这样，您将根据您是否有字段text或object.

"dynamic_templates":[
   {
      "alert_object_text":{
         "path_match":"alert.*",
         "match_mapping_type":"text",
         "mapping":{
            "type":"text"
         }
      }
   },
   {
      "alert_object_object":{
         "path_match":"alert.*",
         "match_mapping_type":"object",
         "mapping":{
            "type":"object"
         }
      }
   }
]