在elasticsearch中一个index下面会有很多的type,在一个项目中type的数量未知,所以在建立template的时候需要mapping不指定type(对所有的type有效)
因此需要用到_default_
字段:
PUT /my_index{
"mappings": {
"_default_": {
"properties": {
"field1": {
"type": "string",
"index": "analyzed"
}
}
}
}
在项目中需要用到的配置帖出来,大家参考:
{
"template":"projectlog*",
"settings":{
"number_of_shards" : 5
},
"mappings": {
"_default_": {
"_source" : { "enabled" : true },
"properties": {
"additionInfo": {
"type": "string",
"index": "not_analyzed" },
"devEnv": {
"type": "string",
"index": "not_analyzed" },
"eventId": {
"type": "string",
"index": "not_analyzed" },
"eventName": {
"type": "string",
"index": "not_analyzed" },
"hit": {
"type": "integer" },
"hitRules": {
"type": "string",
"index": "not_analyzed" },
"ip": {
"type": "string",
"index": "not_analyzed" },
"mainBody": {
"type": "string",
"index": "not_analyzed" },
"requestTime": {
"type": "long" },
"riskParam": {
"index": "not_analyzed",
"type": "string" },
"ruleId": {
"type": "string",
"index": "not_analyzed" },
"serialNumber": {
"type": "string",
"index": "not_analyzed" },
"shootPenalties": {
"type": "string",
"index": "not_analyzed" }
}
}
}
}