logstash conf的output内容
output {
if [type]=="bbs" {
elasticsearch {
hosts => ["http://es.service:9200"]
user => ""
password => ""
document_id => "%{tid}"
index => "bbs-v1"
template => "/data/tasks/logstash/template/bbs_template.json"
template_name => "bbs"
template_overwrite => true
}
}
#stdout { codec => rubydebug }
}
bbs_template.json
/***
官方文档:
https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-templates.html
https://blog.csdn.net/napoay/article/details/73100110?locationNum=9&fps=1#310-format
****/
{
"template":"bbs*",
"order":10,
"settings":{
"index.number_of_shards":5,
"number_of_replicas": 0,
"index.refresh_interval": "5s",
"index.max_result_window":10000000
},
"mappings": {
"_default_": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"analyzer_fileds"/*可以自己随便写*/: {
//"path_match": "subject",
"match": "subject", /*subject数据库表字段*/
/*path_match|match 对于mysql来说,查出来就一个主json对象,没有mongdb里的子节点,
如:article.title 可以用 path_match(按路径匹配)来匹配
title 直接用 match 匹配就行
*/
"match_mapping_type": "string",/*配置数据类型*/
"mapping": {
"type": "text",/*text才能做es(5.多版本)的索引与拆词,string不行*/
"norms": false,/*是否启用搜索匹配评分排序,关闭节省空间*/
"analyzer": "ik_max_word",
"search_analyzer":"ik_smart"
}
}
},
{
"string_fields": {
/*配置所有的string的字段*/
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "string",
"index": "not_analyzed",
"doc_values": true
}
}
}
],
"properties": {
"displayorder": {
"type": "integer"
},
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
}
}
}
}
}
网友评论