我希望我的字符串not_analyzed
既可以用于搜索,也可以用于 Kibana 中的可视化。
我创建了一个自定义 elasticsearch-template.json 来将字符串的默认设置为not_analyzed
,并在我的 logstash-log4j.conf 文件中指出了这一点。这是弹性搜索模板.json:
{
"template" : "logstash-*",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "analyzed", "omit_norms" : true
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "not_analyzed", "omit_norms" : true,
}
}
} ],
"properties" : {
"@version": { "type": "string", "index": "not_analyzed" },
"geoip" : {
"type" : "object",
"dynamic": true,
"properties" : {
"location" : { "type" : "geo_point" }
}
}
}
}
}
}
我将此文件与我的 logstash-log4j.com 位于同一目录中,其中包含:
output {
stdout {
codec => rubydebug
}
elasticsearch {
cluster => 'hlt_logs'
index => 'logstash-symphony'
template => "/elk/logstash/current/elasticsearch-template.json"
}
}
进行这些更改后,我使用 curl 删除并替换了 elasticsearch 索引:
curl -XDELETE -i 'http://localhost:9200/logstash-symphony'
curl -XPUT -i 'http://localhost:9200/logstash-symphony'
我添加了一些新日志并在 Kibana 中进行可视化,但我仍然将字符串作为分析字段。我错过了什么?