alias数据类型

alias数据类型

在使用alias时，字段别名的目标有一些限制：

• 它必须是一个具体的字段（不是一个对象或者是另外一个alias）
• 它必须在alias被创建时已经存在
• 如果是一个nested的对象，那么alias必须具有和它的目标具有同样的nested scope

案例1

PUT trips
{
  "mappings": {
    "properties": {
      "distance": {
        "type": "long"
      },
      "route_length_miles": {
        "type": "alias",
        "path": "distance" 
      },
      "transit_mode": {
        "type": "keyword"
      }
    }
  }
}

输入两个文档，并搜索

PUT trips/_doc/1
{
  "distance": 100,
  "transit_mode": "mode1"
}
 
PUT trips/_doc/2
{
  "distance": 50,
  "transit_mode": "mode2"
}
 
GET _search
{
  "query": {
    "range" : {
      "route_length_miles" : {
        "gte" : 60
      }
    }
  }
}

结果显示

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "trips",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "distance" : 100,
          "transit_mode" : "mode1"
        }
      }
    ]
  }
}

案例2

PUT logs_server
{
  "mappings": {
    "properties": {
      "http": {
        "properties": {
          "request": {
            "properties": {
              "method": {
                "type": "alias",
                "path": "method.keyword"
              }
            }
          }
        }
      },
      "method": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

在上面，定义了两个字段，其中的一个字段是 alias:

• method.keyword
• http.request.method

其中 http.request.method 被定义为 alias 指向 method.keyword。

插入文档

PUT logs_server/_doc/1
{
  "method": "GET"
}

搜索

GET logs_server/_search
{
  "query": {
    "match": {
      "http.request.method": "GET"
    }
  }
}

使用alias数据来遵循ECS

准备数据

POST logs_server1/_doc/
{
  "level": "info"
}
 
POST logs_server2/_doc/
{
  "log_level": "info"
}

查看索引mapping

GET logs_server1/_mapping

{
  "logs_server1" : {
    "mappings" : {
      "properties" : {
        "level" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

GET logs_server2/_mapping

{
  "logs_server2" : {
    "mappings" : {
      "properties" : {
        "log_level" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

统计 logs 按照级别 level 进行统计的话，只能按照如下的方法来进行

GET logs_server*/_search
{
  "size": 0,
  "aggs": {
    "levels": {
      "terms": {
        "script": {
          "source": """
             if (doc.containsKey('level.keyword')) {
               return doc['level.keyword'].value
             } else {
               return doc['log_level.keyword'].value
             }
             
          """
        }
      }
    }
  }
}

在上面脚本中的 doc，其实就是 doc_values。

使用alias数据类型把数据归一化

对logs_server1做如下操作

PUT logs_server1/_mapping
{
  "properties": {
    "log": {
      "properties": {
        "level": {
          "type": "alias",
          "path": "level.keyword"
        }
      }
    }
  }
}

对logs_server2做如下操作

PUT logs_server2/_mapping
{
  "properties": {
    "log": {
      "properties": {
        "level": {
          "type": "alias",
          "path": "log_level.keyword"
        }
      }
    }
  }
}

统计方法如下

GET  logs_server*/_search
{
  "size": 0,
  "aggs": {
    "levels": {
      "terms": {
        "field": "log.level",
        "size": 10
      }
    }
  }
}