elasticsearch聚合时提示Fielddata is disabled on text fields by default或Set update_all_types to true to

执行以下es聚合语句:

GET threats/attack/_search
{
  "aggs": {
    "srcIp": {
      "terms": { "field": "info.src_ip"}
    }
  }
}

报错:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [info.src_ip] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "megacorp",
        "node": "jbFtoSVqQAqfYhE5uTBFvw",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [info.src_ip] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."
        }
      }
    ]
  },
  "status": 400
}

原因:Elasticsearch 5.x版本以后,对排序和聚合等操作,用单独的数据结构(fielddata)缓存到内存里了,默认是不开启的,需要单独开启

解决办法

PUT threats/_mapping/attack
{
  "properties": {
    "info.src_ip": { 
      "type":     "text",
      "fielddata": true
    }
  }
}

在这里插入图片描述执行命令后,返回acknowledge:true,代表成功

若报下面错误:
在这里插入图片描述原因:因为字典名称重复使用所以要使用update_all_types 会更新所有字段名相同的属性

解决办法:加上?update_all_types即可,如下图:
在这里插入图片描述

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值