如何更新Elasticsearch映射更改字段的數據類型和更改分析儀的類型串

Question

嘗試更新的映射我得到以下錯誤：

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"mapper [timestamp] of different type, current_type [string], merged_type [date]"}],"type":"illegal_argument_exception","reason":" 
mapper [timestamp] of different type, current_type [string], merged_type [date]"},"status":400} 

餘米試圖運行下面的命令在窗口上

curl -XPUT localhost:9200/logstash-*/_mapping/log?update_all_types -d "{ 
    "properties": 
    { 
     "timestamp": 
     { 
      "type": "date", 
      "format": "MM-dd-yyyy HH:mm:ss", 
      "fielddata":{"loading" : "lazy"} } 
     } 
    }"; 

如何可以更改日期字段的數據類型從字符串日期類型與特定格式。

我試圖改變一個字符串數據類型，將其更改爲eager加載和分析not_analyzed的映射，但它提供了以下錯誤：

{"root_cause":[{"type":"illegal_argument_exception","reason":"Mapper for [AppName] conflicts with existing mapping in other types:\n[mapper [AppName] has different [index] values, mapper [App 
different [doc_values] values, cannot change from disabled to enabled, mapper [AppName] has different [analyzer]]"}],"type":"illegal_argument_exception","reason":"Mapper for [AppName] conflict with 
existing mapping in other types:\n[mapper [AppName] has different [index] values, mapper [AppName] has different [doc_values] values, cannot change from disabled to enabled, mapper [AppName] 
rent [analyzer]]"},"status":400} 

這裏是我的同一個查詢：

curl -XPUT localhost:9200/logstash-*/_mapping/log?update_all_types -d "{ 
"properties": 
    {"AppName": 
     { 
     "type": "string", 
     "index" : "not_analyzed", 
     "fielddata":{"loading" : "eager"} 
     } 
    } 
}" 

但是，如果我將其從not_analyzed更改爲analyzed，它會給出acknowledged=true消息。我怎樣才能改變分析儀。

Answer 1

您無法更改現有的數據類型映射。作爲彈性文檔說：

Although you can add to an existing mapping, you can’t change existing field mappings. If a mapping already exists for a field, data from that field has probably been indexed. If you were to change the field mapping, the indexed data would be wrong and would not be properly searchable.

We can update a mapping to add a new field, but we can’t change an existing field from analyzed to not_analyzed.

你唯一的選擇是創建新的映射一個新的指數，從舊索引到新的一個重新索引數據。

Answer 2

不，您不能更改單個字段的定義。

如果要更改單個字段中單個字段的字段定義，除了索引中的所有文檔之外，沒有其他選擇。

---

爲什麼你不能改變映射？本文Changing Mapping with Zero Downtime解釋，

In order to make your data searchable, your database needs to know what type of data each field contains and how it should be indexed.

If you switch a field type from e.g. a string to a date, all of the data for that field that you already have indexed becomes useless. One way or another, you need to reindex that field.

This applies not just to Elasticsearch, but to any database that uses indices for searching. And if it isn't using indices then it is sacrificing speed for flexibility.

---

會發生什麼事，當你指數與不正確的字段類型的文件？

轉換將被嘗試。如果不存在有效的轉換，則會引發異常。

Elasticsearch: The Definitive Guide有一個關於一個例子的說明，輸入了string，但預計有long。轉換將被嘗試。但是如果不存在有效的轉換，則仍會拋出異常。

[...] if the field is already mapped as type long, then ES will try to convert the string into a long, and throw an exception if it can’t.

---

我能得到的文件索引無論如何，忽略了殘缺的字段？

是的。 ES5提供了一個ignore_malformed mapping參數。Elasticsearch Reference解釋說，

Trying to index the wrong datatype into a field throws an exception by default, and rejects the whole document. The ignore_malformed parameter, if set to true, allows the exception to be ignored. The malformed field is not indexed, but other fields in the document are processed normally.