关于elastic接受logstash传入的数据的聚合问题

本来上网搜的都是_mapping方法

{"properties": {"host": {"type":"text","fielddata": true}}}

报错

{'error': {'root_cause': [{'type': 'illegal_argument_exception', 'reason': 'Mapper for [host] conflicts with existing mapping in other types:\n[mapper [host] has different [norms] values, cannot change from disable to enabled]'}], 'type': 'illegal_argument_exception', 'reason': 'Mapper for [host] conflicts with existing mapping in other types:\n[mapper [host] has different [norms] values, cannot change from disable to enabled]'}, 'status': 400}

后来偶然注意到keyword的方法, 想起查看到的映射结构, 原来logstash早有准备了

          "host" : {
            "type" : "text",
            "norms" : false,
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },

                query_all = {
                    "aggs": {
                        "host": {
                            "terms": {
                                "field": "host.keyword"
                            }
                        }
                    }
                }

话说csdn怎么不能用md了?