之前在配置从logstash写数据到elasticsearch时,指定单个数据模板没有问题,但是在配置多个数据模板时候,总是不成功,后来找了很多资料,终于找到解决办法,就是要多加一个配置项: template_name ,切该名字必须全部为小写。
参考配置信息:
output {
if [type] == "log_01" {
elasticsearch {
cluster => 'elasticsearch'
host => 'x.x.x.x'
index => 'log_01-%{+YYYY-MM-dd}'
port => '9300'
workers => 1
template => "/data/logstash/conf/template_01.json"
template_name => "template_01.json"
template_overwrite => true
}
}
if [type] == "log_02" {
elasticsearch {
cluster => 'elasticsearch'
host => 'x.x.x.x'
index => 'log_02-%{+YYYY-MM-dd}'
port => '9300'
workers => 1
template => "/data/logstash/conf/template_02.json"
template_name => "template_01.json"
template_overwrite => true
}
}
}
模板的配置请参见:http://qindongliang.iteye.com/blog/2290384
没指定之前的写法:
修改后的文件格式:
temp.json参考格式:
{
"template": "index_ytx_inlife_item_category",
"version": 50001,
"settings": {
"index.refresh_interval": "5s"
},
"mappings": {
"_default_": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"template_1" : {
"match" : "name",
"mapping" : {
"type" : "string",
"analyzer":"ik_smart",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
}
}
},
{
"template_2" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string",
"index" : "not_analyzed"
}
}
}
]
}
}
}