弹性搜索如何添加新字段并从现有字段中获取值

Question

我有一个弹性搜索索引如下，

 {
  "payment_transaction": {
    "mappings": {
      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date"
          }
        }
      }
    }
  }
}

而且我需要添加另外三个字段（年、月、日）。并且需要从现有字段中分配值 (created_date)。 created_date 的格式为 2016-11-22T22:20:21.000Z。我怎样才能做到这一点？弹性搜索版本为 5.0.

Answer 1

解决方法是使用 copy_to 映射选项将 created_date 字段复制到单独的文本字段。然后可以使用 pattern_replace 字符过滤器分析文本字段以提取年、月、日，如下例所示：

示例：

put test 
{
    "settings": {
        "analysis": {
            "char_filter": {
                "year" : {
                    "type": "pattern_replace",
                    "pattern": "(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}.\d{3}Z",
                    "replacement": ""
                },
                "month" : {
                    "type": "pattern_replace",
                    "pattern": "(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}.\d{3}Z",
                    "replacement": ""
                },
                "day" : {
                    "type": "pattern_replace",
                       "pattern": "(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}.\d{3}Z",
                    "replacement": ""
                }
            },
            "analyzer": {
                "year" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["year"]
                },
                "month" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["month"]
                },
                "day" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["day"]
                }

            }
        }
    }
}
put test/message_logs/_mapping
{


      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date",

            "copy_to" : ["year","month","day"]
          },
           "year": {
            "type": "text",
            "analyzer" : "year",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "month": {
                 "type": "text",
            "analyzer" : "month",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "day": {
               "type": "text",
            "analyzer" : "day",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          }
        }
      }


}

put test/message_logs/1 
{
    "created_date" : "2016-11-22T22:20:21.000Z"
}

post test/message_logs/_search
{
    "fielddata_fields": [
       "year",
       "month",
       "day"
    ]
}

结果：

    {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1,
      "max_score": 1,
      "hits": [
         {
            "_index": "test",
            "_type": "message_logs",
            "_id": "1",
            "_score": 1,
            "_source": {
               "created_date": "2016-11-22T22:20:21.000Z"
            },
            "fields": {
               "month": [
                  "11"
               ],
               "year": [
                  "2016"
               ],
               "day": [
                  "22"
               ]
            }
         }
      ]
   }
}

fielddata 不必是 true 并且仅为示例目的而启用。

弹性搜索如何添加新字段并从现有字段中获取值

Elastic search how to add new field and put value from existing field

elasticsearch

elasticsearch-5