一、背景
Elasticsearch发展实在太快,半年前ELK部署的V6.5,现在已经出到V7.7X。为了适应时代的发展,部署了下7.7.0。
做了下索引管理(之前这块并不重视,顺便学习记录下)
学习内容:
- 定义创建模版
- 修改模版
- 重建索引
- 新增索引别名
起因:索引字段属性缺乏fielddata属性,无法做聚合查询。
二、创建mapping模版(一次定义多次使用,减少重复内容定义)
curl -H "Content-Type: application/json" -XPUT http://172.25.2.203:9200/_template/news_template -d ' { "template": "stock_news*", "order":0, "settings": { "index": { "refresh_interval": "5s", "number_of_shards": "1", "number_of_replicas": "0" } }, "mappings": { "properties": { "title": { "type": "text", "analyzer": "ik_smart" }, "content": { "type" : "text", "index": "false" }, "url": { "type" : "text", "index": "false" }, "ctime": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis" } } } } ' |
三、使用python爬取采集数据(略,使用python+beautifulsoup采集些简单数据)
四、对title字段进行聚合查询
GET /stock_news_sina/_doc/_search
"size" : 0,
"aggs" : {
"groupby_title" : {
"terms" : {
"size" : 10,
"field" : "title"
}
}
}
}
报错:
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)
elasticsearch.exceptions.RequestError: TransportError(400, 'search_phase_execution_exception', 'Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [title] in order to load field data by uninverting the inverted index. Note that this can use significant memory.')
根据提示寻找解决方案:
https://developer.aliyun.com/article/707393
text类型字段的属性要添加 set fielddata=true 才能做聚合查询
五、重新定义mapping模版
curl -XDELETE http://172.25.2.203:9200/_template/stocknews_template
curl -H "Content-Type: application/json" -XPUT http://172.25.2.203:9200/_template/news_template -d ' “fielddata“ : ”true",
|
六、重建索引(复制新建,删除旧索引)
curl -H "Content-Type: application/json" -XPOST http://172.25.2.203:9200/_reindex -d ' { "source": { "index": "stock_news_sina" }, "dest": { "index": "stock_news_sina_v1" } } ' 可选参数
|
七、为了兼容之前的访问和采集,新建索引别名对外服务(官方推荐的做法)
新增 curl -H "Content-Type: application/json" -XPOST http://172.25.2.203:9200/_aliases -d '
删除 curl -H "Content-Type: application/json" -XPOST http://172.25.2.203:9200/_aliases -d '
|
验证:
GET /stock_news_sina/_doc/_search
"size" : 0,
"aggs" : {
"groupby_title" : {
"terms" : {
"size" : 10,
"field" : "title"
}
}
}
}