如何更新 Elasticsearch 中的映射以更改字段数据类型并更改字符串中的分析器类型

Question

尝试更新映射时出现以下错误：

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"mapper [timestamp] of different type, current_type [string], merged_type [date]"}],"type":"illegal_argument_exception","reason":"
mapper [timestamp] of different type, current_type [string], merged_type [date]"},"status":400}

我正在尝试运行在 windows

上执行以下命令

   curl -XPUT localhost:9200/logstash-*/_mapping/log?update_all_types -d "{
    "properties":
    {
        "timestamp": 
        {
            "type": "date", 
            "format": "MM-dd-yyyy HH:mm:ss",
            "fielddata":{"loading" : "lazy"} }
        }
    }";

如何将日期字段的数据类型从字符串更改为具有特定格式的日期类型。

我尝试更改字符串数据类型的映射以将其更改为 eager 加载和 not_analyzed 从分析，但它给出以下错误：

{"root_cause":[{"type":"illegal_argument_exception","reason":"Mapper for [AppName] conflicts with existing mapping in other types:\n[mapper [AppName] has different [index] values, mapper [App
 different [doc_values] values, cannot change from disabled to enabled, mapper [AppName] has different [analyzer]]"}],"type":"illegal_argument_exception","reason":"Mapper for [AppName] conflict with
existing mapping in other types:\n[mapper [AppName] has different [index] values, mapper [AppName] has different [doc_values] values, cannot change from disabled to enabled, mapper [AppName]
rent [analyzer]]"},"status":400}

这是我的查询：

 curl -XPUT localhost:9200/logstash-*/_mapping/log?update_all_types -d "{
"properties":
    {"AppName":
        {
        "type": "string", 
        "index" : "not_analyzed",
        "fielddata":{"loading" : "eager"}
        }
    }
}"

但是，如果我将它从 not_analyzed 更改为 analyzed，它会显示 acknowledged=true 消息。我怎样才能改变分析仪。

Answer 1

您不能更改现有的数据类型映射。正如 Elastic 文档所说：

Although you can add to an existing mapping, you can’t change existing field mappings. If a mapping already exists for a field, data from that field has probably been indexed. If you were to change the field mapping, the indexed data would be wrong and would not be properly searchable.

We can update a mapping to add a new field, but we can’t change an existing field from analyzed to not_analyzed.

您唯一的选择是使用新映射创建新索引并将数据从旧索引重新索引到新索引。

Answer 2

不，您不能更改单个字段定义。

如果您想更改单一类型中单个字段的字段定义，您别无选择，只能重新索引索引中的所有文档。

为什么不能更改映射？这篇文章Changing Mapping with Zero Downtime解释了，

In order to make your data searchable, your database needs to know what type of data each field contains and how it should be indexed.

If you switch a field type from e.g. a string to a date, all of the data for that field that you already have indexed becomes useless. One way or another, you need to reindex that field.

This applies not just to Elasticsearch, but to any database that uses indices for searching. And if it isn't using indices then it is sacrificing speed for flexibility.

当您为包含错误字段类型的文档编制索引时会发生什么情况？

将尝试转换。如果不存在有效转换，则抛出异常。

Elasticsearch: The Definitive Guide 有一个关于示例的注释，输入的是 string，但应输入 long。将尝试转换。但如果不存在有效转换，仍然会抛出异常。

[...] if the field is already mapped as type long, then ES will try to convert the string into a long, and throw an exception if it can’t.

我能否将文档编入索引，忽略格式错误的字段？

是的。 ES5 提供了一个 ignore_malformed mapping 参数。 Elasticsearch Reference 解释说，

Trying to index the wrong datatype into a field throws an exception by default, and rejects the whole document. The ignore_malformed parameter, if set to true, allows the exception to be ignored. The malformed field is not indexed, but other fields in the document are processed normally.

如何更新 Elasticsearch 中的映射以更改字段数据类型并更改字符串中的分析器类型

How to update the mapping in Elasticsearch to change the field datatype and change the type of analyzers in string

mapping

elasticsearch