无法生成 geo_point 数据类型为 geo_point 的字段 Logstash

Question

我正在尝试使用 logstash 从 mysql table ES 索引加载数据。我能够将数据加载到 ES，但位置字段映射不是 geo_point 类型。它显示为关键字类型。这样我就无法查询 geo_point 字段。

任何帮助是什么问题？ ES版本：6.7.0

这是我的 template.json 文件：

{
    "settings" :
    {
        "number_of_shards" : 1,
        "codec": "best_compression",
        "number_of_replicas" : 0,
        "index.translog.flush_threshold_size": "2g",
        "bootstrap.mlockall": true,
        "indices.fielddata.cache.size": 25%
    },
    "mappings":
    {
            "_doc" :
            '|            "dynamic_templates":
              [
                  {
                      "message_field": {
                        "path_match": "message",
                        "match_mapping_type": "string",
                        "mapping": {
                          "type": "text",
                          "norms": false
                        }
                      }
                    },
                    {
                      "string_fields": {
                        "match": "*",
                        "match_mapping_type": "string",
                        "mapping": {
                          "type": "text",
                          "norms": false,
                          "fields": {
                            "keyword": {
                              "type": "keyword",
                              "ignore_above": 256
                            }
                          }
                        }
                      }
                    }
              ],
"properties" : {
                "@timestamp": {
                     "type": "date"
                },
                "@version": {
                     "type": "keyword"
                },
                "location": {
                     "type": "geo_point"
                },
                "lat" : { "type" : "keyword", "index" : "not_analyzed","index_options" : "docs" },
                "lon" : { "type" : "keyword", "index" : "not_analyzed","index_options" : "docs" }
              }
            }
    }
}

logstash.conf 文件输入

{
        jdbc {
                ..........
    }
}
filter
{
    mutate {
        convert => { "lon" => "float" }
        convert => { "lat" => "float" }
        rename => {
            "lon" => "[location][lon]"
            "lat" => "[location][lat]"
        }
    }
}
output {
  elasticsearch {
        hosts => "host:80"
        index => "my_index"
        manage_template => "false"
        document_type => "_doc"
        template_name=>"template.json"
        document_id => "%{id}"
  }
}

Answer 1

我认为你只是缺少 manage_template => true，你也可以添加 template_overwrite => true 以确保模板被覆盖：

  elasticsearch {
        hosts => "host:80"
        index => "my_index"
        manage_template => "true"             <---- change this
        template_overwrite => true            <---- also add this
        document_type => "_doc"
        template_name=>"template.json"
        document_id => "%{id}"
  }

无法生成 geo_point 数据类型为 geo_point 的字段 Logstash

Not Able to generate geo_point field with geo_point data type Logstash

elasticsearch

logstash

elasticsearch-5

aws-elasticsearch