小编Val*_*tin的帖子

我正在尝试使用elasticsearch进行实时数据过滤.现在我使用一台机器不断推送新数据(通过_bulk每隔3秒).即便如此,我确实设置了一个ttl,索引在一天左右后变得非常大,然后elasticsearch挂起.我目前的映射:

curl -XPOST localhost:9200/live -d '{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0,
    "analysis": {
      "analyzer": {
        "lowercase_keyword": {
          "type": "custom",
          "tokenizer": "whitespace",
          "filter": [
            "lowercase"
          ]
        },
        "no_keyword": {
          "type": "custom",
          "tokenizer": "whitespace",
          "filter": []
        }
      }
    }
  },
  "mappings": {
    "log": {
      "_timestamp": {
        "enabled": true,
        "path": "datetime"
      },
      "_ttl":{
        "enabled":true,
        "default":"8h"
      },
      "properties": {
        "url": {
          "type": "string",
          "search_analyzer": "lowercase_keyword",
          "index_analyzer": "lowercase_keyword"
        },
        "q": {
          "type": "string",
          "search_analyzer": "no_keyword",
          "index_analyzer": "no_keyword"
        },
        "datetime" : {
          "type" : "date" …