美文网首页
ElasticSearch 索引&分片&文档概念

ElasticSearch 索引&分片&文档概念

作者: 与狼共舞666 | 来源:发表于2023-04-02 17:36 被阅读0次

    索引信息:


    image.png
    {
    "version": 31,
    "mapping_version": 4,
    "settings_version": 3,
    "aliases_version": 3,
    "routing_num_shards": 30,
    "state": "open",
    "settings": {
    "index": {
    "mapping": {
    "total_fields": {
    "limit": "2000"
    }
    },
    "refresh_interval": "1s",
    "translog": {
    "sync_interval": "5s",
    "durability": "request"
    },
    "provided_name": "<apm-7.5.1-transaction-000032>",
    "query": {
    "default_field": [
    "message"
    ,
    "tags"
    ,
    "agent.ephemeral_id"
    ,
    "agent.id"
    ,
    "agent.name"
    ,
    "agent.type"
    ,
    "agent.version"
    ,
    "as.organization.name"
    ,
    "client.address"
    ,
    "client.as.organization.name"
    ,
    "client.domain"
    ,
    "client.geo.city_name"
    ,
    "client.geo.continent_name"
    ,
    "client.geo.country_iso_code"
    ,
    "client.geo.country_name"
    ,
    "client.geo.name"
    ,
    "client.geo.region_iso_code"
    ,
    "client.geo.region_name"
    ,
    "client.mac"
    ,
    "client.user.domain"
    ,
    "client.user.email"
    ,
    "client.user.full_name"
    ,
    "client.user.group.id"
    ,
    "client.user.group.name"
    ,
    "client.user.hash"
    ,
    "client.user.id"
    ,
    "client.user.name"
    ,
    "cloud.account.id"
    ,
    "cloud.availability_zone"
    ,
    "cloud.instance.id"
    ,
    "cloud.instance.name"
    ,
    "cloud.machine.type"
    ,
    "cloud.provider"
    ,
    "cloud.region"
    ,
    "container.id"
    ,
    "container.image.name"
    ,
    "container.image.tag"
    ,
    "container.name"
    ,
    "container.runtime"
    ,
    "destination.address"
    ,
    "destination.as.organization.name"
    ,
    "destination.domain"
    ,
    "destination.geo.city_name"
    ,
    "destination.geo.continent_name"
    ,
    "destination.geo.country_iso_code"
    ,
    "destination.geo.country_name"
    ,
    "destination.geo.name"
    ,
    "destination.geo.region_iso_code"
    ,
    "destination.geo.region_name"
    ,
    "destination.mac"
    ,
    "destination.user.domain"
    ,
    "destination.user.email"
    ,
    "destination.user.full_name"
    ,
    "destination.user.group.id"
    ,
    "destination.user.group.name"
    ,
    "destination.user.hash"
    ,
    "destination.user.id"
    ,
    "destination.user.name"
    ,
    "dns.answers.class"
    ,
    "dns.answers.data"
    ,
    "dns.answers.name"
    ,
    "dns.answers.type"
    ,
    "dns.header_flags"
    ,
    "dns.id"
    ,
    "dns.op_code"
    ,
    "dns.question.class"
    ,
    "dns.question.name"
    ,
    "dns.question.registered_domain"
    ,
    "dns.question.type"
    ,
    "dns.response_code"
    ,
    "dns.type"
    ,
    "ecs.version"
    ,
    "error.code"
    ,
    "error.id"
    ,
    "error.message"
    ,
    "event.action"
    ,
    "event.category"
    ,
    "event.code"
    ,
    "event.dataset"
    ,
    "event.hash"
    ,
    "event.id"
    ,
    "event.kind"
    ,
    "event.module"
    ,
    "event.original"
    ,
    "event.outcome"
    ,
    "event.provider"
    ,
    "event.timezone"
    ,
    "event.type"
    ,
    "file.device"
    ,
    "file.directory"
    ,
    "file.extension"
    ,
    "file.gid"
    ,
    "file.group"
    ,
    "file.hash.md5"
    ,
    "file.hash.sha1"
    ,
    "file.hash.sha256"
    ,
    "file.hash.sha512"
    ,
    "file.inode"
    ,
    "file.mode"
    ,
    "file.name"
    ,
    "file.owner"
    ,
    "file.path"
    ,
    "file.target_path"
    ,
    "file.type"
    ,
    "file.uid"
    ,
    "geo.city_name"
    ,
    "geo.continent_name"
    ,
    "geo.country_iso_code"
    ,
    "geo.country_name"
    ,
    "geo.name"
    ,
    "geo.region_iso_code"
    ,
    "geo.region_name"
    ,
    "group.id"
    ,
    "group.name"
    ,
    "hash.md5"
    ,
    "hash.sha1"
    ,
    "hash.sha256"
    ,
    "hash.sha512"
    ,
    "host.architecture"
    ,
    "host.geo.city_name"
    ,
    "host.geo.continent_name"
    ,
    "host.geo.country_iso_code"
    ,
    "host.geo.country_name"
    ,
    "host.geo.name"
    ,
    "host.geo.region_iso_code"
    ,
    "host.geo.region_name"
    ,
    "host.hostname"
    ,
    "host.id"
    ,
    "host.mac"
    ,
    "host.name"
    ,
    "host.os.family"
    ,
    "host.os.full"
    ,
    "host.os.kernel"
    ,
    "host.os.name"
    ,
    "host.os.platform"
    ,
    "host.os.version"
    ,
    "host.type"
    ,
    "host.user.domain"
    ,
    "host.user.email"
    ,
    "host.user.full_name"
    ,
    "host.user.group.id"
    ,
    "host.user.group.name"
    ,
    "host.user.hash"
    ,
    "host.user.id"
    ,
    "host.user.name"
    ,
    "http.request.body.content"
    ,
    "http.request.method"
    ,
    "http.request.referrer"
    ,
    "http.response.body.content"
    ,
    "http.version"
    ,
    "log.level"
    ,
    "log.logger"
    ,
    "log.original"
    ,
    "network.application"
    ,
    "network.community_id"
    ,
    "network.direction"
    ,
    "network.iana_number"
    ,
    "network.name"
    ,
    "network.protocol"
    ,
    "network.transport"
    ,
    "network.type"
    ,
    "observer.geo.city_name"
    ,
    "observer.geo.continent_name"
    ,
    "observer.geo.country_iso_code"
    ,
    "observer.geo.country_name"
    ,
    "observer.geo.name"
    ,
    "observer.geo.region_iso_code"
    ,
    "observer.geo.region_name"
    ,
    "observer.hostname"
    ,
    "observer.mac"
    ,
    "observer.os.family"
    ,
    "observer.os.full"
    ,
    "observer.os.kernel"
    ,
    "observer.os.name"
    ,
    "observer.os.platform"
    ,
    "observer.os.version"
    ,
    "observer.serial_number"
    ,
    "observer.type"
    ,
    "observer.vendor"
    ,
    "observer.version"
    ,
    "organization.id"
    ,
    "organization.name"
    ,
    "os.family"
    ,
    "os.full"
    ,
    "os.kernel"
    ,
    "os.name"
    ,
    "os.platform"
    ,
    "os.version"
    ,
    "process.args"
    ,
    "process.executable"
    ,
    "process.hash.md5"
    ,
    "process.hash.sha1"
    ,
    "process.hash.sha256"
    ,
    "process.hash.sha512"
    ,
    "process.name"
    ,
    "process.thread.name"
    ,
    "process.title"
    ,
    "process.working_directory"
    ,
    "server.address"
    ,
    "server.as.organization.name"
    ,
    "server.domain"
    ,
    "server.geo.city_name"
    ,
    "server.geo.continent_name"
    ,
    "server.geo.country_iso_code"
    ,
    "server.geo.country_name"
    ,
    "server.geo.name"
    ,
    "server.geo.region_iso_code"
    ,
    "server.geo.region_name"
    ,
    "server.mac"
    ,
    "server.user.domain"
    ,
    "server.user.email"
    ,
    "server.user.full_name"
    ,
    "server.user.group.id"
    ,
    "server.user.group.name"
    ,
    "server.user.hash"
    ,
    "server.user.id"
    ,
    "server.user.name"
    ,
    "service.ephemeral_id"
    ,
    "service.id"
    ,
    "service.name"
    ,
    "service.state"
    ,
    "service.type"
    ,
    "service.version"
    ,
    "source.address"
    ,
    "source.as.organization.name"
    ,
    "source.domain"
    ,
    "source.geo.city_name"
    ,
    "source.geo.continent_name"
    ,
    "source.geo.country_iso_code"
    ,
    "source.geo.country_name"
    ,
    "source.geo.name"
    ,
    "source.geo.region_iso_code"
    ,
    "source.geo.region_name"
    ,
    "source.mac"
    ,
    "source.user.domain"
    ,
    "source.user.email"
    ,
    "source.user.full_name"
    ,
    "source.user.group.id"
    ,
    "source.user.group.name"
    ,
    "source.user.hash"
    ,
    "source.user.id"
    ,
    "source.user.name"
    ,
    "tracing.trace.id"
    ,
    "tracing.transaction.id"
    ,
    "url.domain"
    ,
    "url.fragment"
    ,
    "url.full"
    ,
    "url.original"
    ,
    "url.password"
    ,
    "url.path"
    ,
    "url.query"
    ,
    "url.scheme"
    ,
    "url.username"
    ,
    "user.domain"
    ,
    "user.email"
    ,
    "user.full_name"
    ,
    "user.group.id"
    ,
    "user.group.name"
    ,
    "user.hash"
    ,
    "user.id"
    ,
    "user.name"
    ,
    "user_agent.device.name"
    ,
    "user_agent.name"
    ,
    "user_agent.original"
    ,
    "user_agent.os.family"
    ,
    "user_agent.os.full"
    ,
    "user_agent.os.kernel"
    ,
    "user_agent.os.name"
    ,
    "user_agent.os.platform"
    ,
    "user_agent.os.version"
    ,
    "user_agent.version"
    ,
    "agent.hostname"
    ,
    "error.type"
    ,
    "timeseries.instance"
    ,
    "cloud.project.id"
    ,
    "cloud.image.id"
    ,
    "host.os.build"
    ,
    "host.os.codename"
    ,
    "kubernetes.pod.name"
    ,
    "kubernetes.pod.uid"
    ,
    "kubernetes.namespace"
    ,
    "kubernetes.node.name"
    ,
    "kubernetes.replicaset.name"
    ,
    "kubernetes.deployment.name"
    ,
    "kubernetes.statefulset.name"
    ,
    "kubernetes.container.name"
    ,
    "kubernetes.container.image"
    ,
    "processor.name"
    ,
    "processor.event"
    ,
    "url.scheme"
    ,
    "url.full"
    ,
    "url.domain"
    ,
    "url.path"
    ,
    "url.query"
    ,
    "url.fragment"
    ,
    "http.version"
    ,
    "http.request.method"
    ,
    "service.name"
    ,
    "service.version"
    ,
    "service.environment"
    ,
    "service.node.name"
    ,
    "service.language.name"
    ,
    "service.language.version"
    ,
    "service.runtime.name"
    ,
    "service.runtime.version"
    ,
    "service.framework.name"
    ,
    "service.framework.version"
    ,
    "transaction.id"
    ,
    "transaction.type"
    ,
    "text"
    ,
    "transaction.name"
    ,
    "span.type"
    ,
    "span.subtype"
    ,
    "trace.id"
    ,
    "parent.id"
    ,
    "agent.name"
    ,
    "agent.version"
    ,
    "agent.ephemeral_id"
    ,
    "container.id"
    ,
    "kubernetes.namespace"
    ,
    "kubernetes.node.name"
    ,
    "kubernetes.pod.name"
    ,
    "kubernetes.pod.uid"
    ,
    "host.architecture"
    ,
    "host.hostname"
    ,
    "host.name"
    ,
    "host.os.platform"
    ,
    "process.args"
    ,
    "process.title"
    ,
    "observer.listening"
    ,
    "observer.hostname"
    ,
    "observer.version"
    ,
    "observer.type"
    ,
    "user.name"
    ,
    "user.id"
    ,
    "user.email"
    ,
    "text"
    ,
    "user_agent.original"
    ,
    "user_agent.name"
    ,
    "user_agent.version"
    ,
    "user_agent.device.name"
    ,
    "user_agent.os.platform"
    ,
    "user_agent.os.name"
    ,
    "user_agent.os.full"
    ,
    "user_agent.os.family"
    ,
    "user_agent.os.version"
    ,
    "user_agent.os.kernel"
    ,
    "error.id"
    ,
    "error.culprit"
    ,
    "error.grouping_key"
    ,
    "error.exception.code"
    ,
    "error.exception.message"
    ,
    "error.exception.module"
    ,
    "error.exception.type"
    ,
    "error.log.level"
    ,
    "error.log.logger_name"
    ,
    "error.log.message"
    ,
    "error.log.param_message"
    ,
    "sourcemap.service.name"
    ,
    "sourcemap.service.version"
    ,
    "sourcemap.bundle_filepath"
    ,
    "view spans"
    ,
    "span.id"
    ,
    "span.name"
    ,
    "span.action"
    ,
    "span.db.link"
    ,
    "transaction.result"
    ,
    "fields.*"
    ]
    },
    "max_result_window": "65536",
    "creation_date": "1676671594061",
    "unassigned": {
    "node_left": {
    "delayed_timeout": "5m"
    }
    },
    "analysis": {
    "analyzer": {
    "default_search": {
    "type": "ik_smart"
    },
    "default": {
    "type": "ik_max_word"
    }
    }
    },
    "priority": "100",
    "number_of_replicas": "1",
    "uuid": "B5nJu3SMTCqO4M6_nQ89wA",
    "version": {
    "created": "7140299"
    },
    "lifecycle": {
    "name": "apm-rollover-30-days",
    "rollover_alias": "apm-7.5.1-transaction",
    "indexing_complete": "true"
    },
    "codec": "best_compression",
    "routing": {
    "allocation": {
    "include": {
    "_tier_preference": "data_content"
    }
    }
    },
    "number_of_shards": "3"
    }
    },
    "mappings": {
    "_doc": {
    "_meta": {
    "beat": "apm",
    "version": "7.5.1"
    },
    "dynamic_templates": [
    {
    "message_full": {
    "mapping": {
    "fields": {
    "keyword": {
    "ignore_above": 2048,
    "type": "keyword"
    }
    },
    "type": "text"
    },
    "match": "message_full"
    }
    }
    ,
    {
    "message": {
    "mapping": {
    "type": "text"
    },
    "match": "message"
    }
    }
    ,
    {
    "strings": {
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "labels": {
    "path_match": "labels.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "container.labels": {
    "path_match": "container.labels.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "dns.answers": {
    "path_match": "dns.answers.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "fields": {
    "path_match": "fields.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "docker.container.labels": {
    "path_match": "docker.container.labels.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "kubernetes.labels.*": {
    "path_match": "kubernetes.labels.*",
    "mapping": {
    "type": "keyword"
    }
    }
    }
    ,
    {
    "kubernetes.annotations.*": {
    "path_match": "kubernetes.annotations.*",
    "mapping": {
    "type": "keyword"
    }
    }
    }
    ,
    {
    "labels2": {
    "path_match": "labels.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "labels3": {
    "path_match": "labels.*",
    "mapping": {
    "type": "boolean"
    },
    "match_mapping_type": "boolean"
    }
    }
    ,
    {
    "labels4": {
    "path_match": "labels.*",
    "mapping": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    }
    }
    }
    ,
    {
    "transaction.marks": {
    "path_match": "transaction.marks.*",
    "mapping": {
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ,
    {
    "transaction.marks.*.*": {
    "path_match": "transaction.marks.*.*",
    "mapping": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    }
    }
    }
    ,
    {
    "strings_as_keyword": {
    "mapping": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "match_mapping_type": "string"
    }
    }
    ],
    "date_detection": false,
    "properties": {
    "container": {
    "dynamic": "false",
    "properties": {
    "image": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "tag": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "runtime": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "labels": {
    "type": "object"
    }
    }
    },
    "kubernetes": {
    "dynamic": "false",
    "properties": {
    "container": {
    "properties": {
    "image": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "node": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "pod": {
    "properties": {
    "uid": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "statefulset": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "namespace": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "annotations": {
    "properties": {
    "*": {
    "type": "object"
    }
    }
    },
    "replicaset": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "deployment": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "labels": {
    "properties": {
    "*": {
    "type": "object"
    }
    }
    }
    }
    },
    "parent": {
    "dynamic": "false",
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "server": {
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "nat": {
    "properties": {
    "port": {
    "type": "long"
    },
    "ip": {
    "type": "ip"
    }
    }
    },
    "as": {
    "properties": {
    "number": {
    "type": "long"
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "address": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "port": {
    "type": "long"
    },
    "bytes": {
    "type": "long"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ip": {
    "type": "ip"
    },
    "user": {
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "packets": {
    "type": "long"
    }
    }
    },
    "agent": {
    "dynamic": "false",
    "properties": {
    "hostname": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ephemeral_id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "log": {
    "properties": {
    "original": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "level": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "logger": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "view spans": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "destination": {
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "nat": {
    "properties": {
    "port": {
    "type": "long"
    },
    "ip": {
    "type": "ip"
    }
    }
    },
    "as": {
    "properties": {
    "number": {
    "type": "long"
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "address": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "port": {
    "type": "long"
    },
    "bytes": {
    "type": "long"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ip": {
    "type": "ip"
    },
    "user": {
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "packets": {
    "type": "long"
    }
    }
    },
    "experimental": {
    "dynamic": "true",
    "type": "object"
    },
    "source": {
    "dynamic": "false",
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "nat": {
    "properties": {
    "port": {
    "type": "long"
    },
    "ip": {
    "type": "ip"
    }
    }
    },
    "as": {
    "properties": {
    "number": {
    "type": "long"
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "address": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "port": {
    "type": "long"
    },
    "bytes": {
    "type": "long"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ip": {
    "type": "ip"
    },
    "user": {
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "packets": {
    "type": "long"
    }
    }
    },
    "error": {
    "dynamic": "false",
    "properties": {
    "exception": {
    "properties": {
    "code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "handled": {
    "type": "boolean"
    },
    "module": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "message": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "culprit": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "log": {
    "properties": {
    "level": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "logger_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "message": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    },
    "param_message": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "grouping_key": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "message": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "docker": {
    "properties": {
    "container": {
    "properties": {
    "labels": {
    "type": "object"
    }
    }
    }
    }
    },
    "network": {
    "properties": {
    "community_id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "forwarded_ip": {
    "type": "ip"
    },
    "protocol": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "application": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "bytes": {
    "type": "long"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "transport": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "iana_number": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "packets": {
    "type": "long"
    },
    "direction": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "cloud": {
    "properties": {
    "availability_zone": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "image": {
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "instance": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "provider": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "machine": {
    "properties": {
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "project": {
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "region": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "account": {
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "observer": {
    "dynamic": "false",
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "listening": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hostname": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "os": {
    "properties": {
    "kernel": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "family": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "platform": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "full": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "vendor": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ip": {
    "type": "ip"
    },
    "serial_number": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version_major": {
    "type": "byte"
    }
    }
    },
    "trace": {
    "dynamic": "false",
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "file": {
    "properties": {
    "owner": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "extension": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "gid": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "created": {
    "type": "date"
    },
    "accessed": {
    "type": "date"
    },
    "mtime": {
    "type": "date"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "directory": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "target_path": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "inode": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "mode": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "path": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "uid": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "size": {
    "type": "long"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ctime": {
    "type": "date"
    },
    "device": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "properties": {
    "sha1": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha256": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha512": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "md5": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "group": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "ecs": {
    "properties": {
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "related": {
    "properties": {
    "ip": {
    "type": "ip"
    }
    }
    },
    "timeseries": {
    "properties": {
    "instance": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "host": {
    "dynamic": "false",
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "hostname": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "os": {
    "properties": {
    "build": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "kernel": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "codename": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "family": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "platform": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "full": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "containerized": {
    "type": "boolean"
    },
    "ip": {
    "type": "ip"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "user": {
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "architecture": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "uptime": {
    "type": "long"
    }
    }
    },
    "client": {
    "dynamic": "false",
    "properties": {
    "geo": {
    "properties": {
    "continent_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "region_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "city_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_iso_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "country_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "location": {
    "type": "geo_point"
    },
    "region_name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "nat": {
    "properties": {
    "port": {
    "type": "long"
    },
    "ip": {
    "type": "ip"
    }
    }
    },
    "as": {
    "properties": {
    "number": {
    "type": "long"
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "address": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "port": {
    "type": "long"
    },
    "bytes": {
    "type": "long"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ip": {
    "type": "ip"
    },
    "user": {
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "mac": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "packets": {
    "type": "long"
    }
    }
    },
    "event": {
    "properties": {
    "severity": {
    "type": "long"
    },
    "code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "original": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "risk_score": {
    "type": "float"
    },
    "created": {
    "type": "date"
    },
    "kind": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "timezone": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "module": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "start": {
    "type": "date"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "duration": {
    "type": "long"
    },
    "sequence": {
    "type": "long"
    },
    "provider": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "risk_score_norm": {
    "type": "float"
    },
    "action": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "end": {
    "type": "date"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "category": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "dataset": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "outcome": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "user_agent": {
    "dynamic": "false",
    "properties": {
    "original": {
    "ignore_above": 1024,
    "type": "keyword",
    "fields": {
    "text": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    }
    }
    },
    "os": {
    "properties": {
    "kernel": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "family": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "platform": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "full": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "device": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "timestamp": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    },
    "process": {
    "dynamic": "false",
    "properties": {
    "args": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "pgid": {
    "type": "long"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "start": {
    "type": "date"
    },
    "pid": {
    "type": "long"
    },
    "working_directory": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "thread": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "type": "long"
    }
    }
    },
    "title": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "executable": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "properties": {
    "sha1": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha256": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha512": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "md5": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "ppid": {
    "type": "long"
    },
    "uptime": {
    "type": "long"
    }
    }
    },
    "tracing": {
    "properties": {
    "trace": {
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "transaction": {
    "properties": {
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "os": {
    "properties": {
    "kernel": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "family": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "platform": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "full": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "sourcemap": {
    "dynamic": "false",
    "properties": {
    "bundle_filepath": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "service": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "dns": {
    "properties": {
    "op_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "resolved_ip": {
    "type": "ip"
    },
    "response_code": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "question": {
    "properties": {
    "registered_domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "class": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "answers": {
    "properties": {
    "data": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "class": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ttl": {
    "type": "long"
    }
    }
    },
    "header_flags": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "message": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    },
    "processor": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "event": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "url": {
    "dynamic": "false",
    "properties": {
    "path": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "fragment": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "password": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "original": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "scheme": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "port": {
    "type": "long"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "query": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "full": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "username": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "labels": {
    "dynamic": "true",
    "type": "object"
    },
    "tags": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "as": {
    "properties": {
    "number": {
    "type": "long"
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "@timestamp": {
    "type": "date"
    },
    "system": {
    "properties": {
    "process": {
    "properties": {
    "memory": {
    "properties": {
    "rss": {
    "properties": {
    "bytes": {
    "type": "long"
    }
    }
    },
    "size": {
    "type": "long"
    }
    }
    },
    "cpu": {
    "properties": {
    "total": {
    "properties": {
    "norm": {
    "properties": {
    "pct": {
    "scaling_factor": 1000,
    "type": "scaled_float"
    }
    }
    }
    }
    }
    }
    }
    }
    },
    "memory": {
    "properties": {
    "actual": {
    "properties": {
    "free": {
    "type": "long"
    }
    }
    },
    "total": {
    "type": "long"
    }
    }
    },
    "cpu": {
    "properties": {
    "total": {
    "properties": {
    "norm": {
    "properties": {
    "pct": {
    "scaling_factor": 1000,
    "type": "scaled_float"
    }
    }
    }
    }
    }
    }
    }
    }
    },
    "service": {
    "dynamic": "false",
    "properties": {
    "node": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "environment": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "framework": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "runtime": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "language": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "state": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "ephemeral_id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "organization": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "http": {
    "dynamic": "false",
    "properties": {
    "request": {
    "properties": {
    "headers": {
    "type": "object",
    "enabled": false
    },
    "referrer": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "method": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "bytes": {
    "type": "long"
    },
    "body": {
    "properties": {
    "bytes": {
    "type": "long"
    },
    "content": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "response": {
    "properties": {
    "headers": {
    "type": "object",
    "enabled": false
    },
    "status_code": {
    "type": "long"
    },
    "bytes": {
    "type": "long"
    },
    "finished": {
    "type": "boolean"
    },
    "body": {
    "properties": {
    "bytes": {
    "type": "long"
    },
    "content": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "version": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "fields": {
    "type": "object"
    },
    "user": {
    "dynamic": "false",
    "properties": {
    "full_name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "domain": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "email": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "hash": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "group": {
    "properties": {
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    },
    "hash": {
    "properties": {
    "sha1": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha256": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sha512": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "md5": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    },
    "transaction": {
    "dynamic": "false",
    "properties": {
    "duration": {
    "properties": {
    "count": {
    "type": "long"
    },
    "sum": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    },
    "us": {
    "type": "long"
    }
    }
    },
    "result": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "self_time": {
    "properties": {
    "count": {
    "type": "long"
    },
    "sum": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    }
    }
    },
    "breakdown": {
    "properties": {
    "count": {
    "type": "long"
    }
    }
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword",
    "fields": {
    "text": {
    "norms": false,
    "analyzer": "default",
    "type": "text"
    }
    }
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "marks": {
    "dynamic": "true",
    "properties": {
    "agent": {
    "properties": {
    "firstContentfulPaint": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domInteractive": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domComplete": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "largestContentfulPaint": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "timeToFirstByte": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    }
    }
    },
    "*": {
    "properties": {
    "*": {
    "dynamic": "true",
    "type": "object"
    }
    }
    },
    "navigationTiming": {
    "properties": {
    "responseEnd": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "responseStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domInteractive": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domainLookupEnd": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domComplete": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domContentLoadedEventStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domainLookupStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "connectEnd": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "connectStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "loadEventStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "requestStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "fetchStart": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domContentLoadedEventEnd": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "domLoading": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    },
    "loadEventEnd": {
    "scaling_factor": 1000000,
    "type": "scaled_float"
    }
    }
    }
    }
    },
    "span_count": {
    "properties": {
    "dropped": {
    "type": "long"
    }
    }
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sampled": {
    "type": "boolean"
    }
    }
    },
    "span": {
    "dynamic": "false",
    "properties": {
    "duration": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    },
    "self_time": {
    "properties": {
    "count": {
    "type": "long"
    },
    "sum": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    }
    }
    },
    "subtype": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "name": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "start": {
    "properties": {
    "us": {
    "type": "long"
    }
    }
    },
    "action": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "id": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "type": {
    "ignore_above": 1024,
    "type": "keyword"
    },
    "sync": {
    "type": "boolean"
    },
    "db": {
    "dynamic": "false",
    "properties": {
    "link": {
    "ignore_above": 1024,
    "type": "keyword"
    }
    }
    }
    }
    }
    }
    }
    },
    "ilm": {
    "phase": "hot",
    "phase_definition": "{"policy":"apm-rollover-30-days","phase_definition":{"min_age":"0ms","actions":{"rollover":{"max_size":"50gb","max_age":"30d"},"set_priority":{"priority":100}}},"version":4,"modified_date_in_millis":1659321198915}",
    "action_time": "1678353995648",
    "phase_time": "1676671594747",
    "action": "complete",
    "step": "complete",
    "creation_date": "1678353994172",
    "step_time": "1678353995648"
    },
    "aliases": [
    "apm-7.5.1-transaction"
    ],
    "primary_terms": {
    "0": 1,
    "1": 1,
    "2": 1
    },
    "in_sync_allocations": {
    "0": [
    "54bEFSk4QZevZ-1xDEh-QQ"
    ,
    "hX8wmkVbR9iRSxQ9QJr13g"
    ],
    "1": [
    "AdfRFVbwRvWZm5nsGuDong"
    ,
    "G7Nk5mKwSSKtO3tnb7vQNw"
    ],
    "2": [
    "iti-Xo4iTA61s1QPIqGH6Q"
    ,
    "YNalaAjqTGyBFcmdTMGXxg"
    ]
    },
    "rollover_info": {
    "apm-7.5.1-transaction": {
    "met_conditions": { },
    "time": 1678353994172
    }
    },
    "system": false,
    "timestamp_range": {
    "unknown": true
    }
    }
    
    索引状态: image.png
    {
    "uuid": "B5nJu3SMTCqO4M6_nQ89wA",
    "primaries": {
    "docs": {
    "count": 130049846,
    "deleted": 0
    },
    "store": {
    "size_in_bytes": 53696736713,
    "total_data_set_size_in_bytes": 53696736713,
    "reserved_in_bytes": 0
    },
    "indexing": {
    "index_total": 130049846,
    "index_time_in_millis": 50472859,
    "index_current": 0,
    "index_failed": 0,
    "delete_total": 0,
    "delete_time_in_millis": 0,
    "delete_current": 0,
    "noop_update_total": 0,
    "is_throttled": false,
    "throttle_time_in_millis": 0
    },
    "get": {
    "total": 0,
    "time_in_millis": 0,
    "exists_total": 0,
    "exists_time_in_millis": 0,
    "missing_total": 0,
    "missing_time_in_millis": 0,
    "current": 0
    },
    "search": {
    "open_contexts": 0,
    "query_total": 55576,
    "query_time_in_millis": 1560939,
    "query_current": 0,
    "fetch_total": 22925,
    "fetch_time_in_millis": 20092,
    "fetch_current": 0,
    "scroll_total": 5630,
    "scroll_time_in_millis": 661971,
    "scroll_current": 0,
    "suggest_total": 0,
    "suggest_time_in_millis": 0,
    "suggest_current": 0
    },
    "merges": {
    "current": 0,
    "current_docs": 0,
    "current_size_in_bytes": 0,
    "total": 495359,
    "total_time_in_millis": 93844734,
    "total_docs": 1647947035,
    "total_size_in_bytes": 1186677308832,
    "total_stopped_time_in_millis": 0,
    "total_throttled_time_in_millis": 30243157,
    "total_auto_throttle_in_bytes": 15728640
    },
    "refresh": {
    "total": 4469232,
    "total_time_in_millis": 70569681,
    "external_total": 4468648,
    "external_total_time_in_millis": 73052444,
    "listeners": 0
    },
    "flush": {
    "total": 572,
    "periodic": 569,
    "total_time_in_millis": 179884
    },
    "warmer": {
    "current": 0,
    "total": 4468645,
    "total_time_in_millis": 682553
    },
    "query_cache": {
    "memory_size_in_bytes": 528196,
    "total_count": 1154758,
    "hit_count": 294477,
    "miss_count": 860281,
    "cache_size": 22,
    "cache_count": 34119,
    "evictions": 34097
    },
    "fielddata": {
    "memory_size_in_bytes": 1926104,
    "evictions": 0
    },
    "completion": {
    "size_in_bytes": 0
    },
    "segments": {
    "count": 96,
    "memory_in_bytes": 1869616,
    "terms_memory_in_bytes": 1410480,
    "stored_fields_memory_in_bytes": 93616,
    "term_vectors_memory_in_bytes": 0,
    "norms_memory_in_bytes": 0,
    "points_memory_in_bytes": 0,
    "doc_values_memory_in_bytes": 365520,
    "index_writer_memory_in_bytes": 0,
    "version_map_memory_in_bytes": 0,
    "fixed_bit_set_memory_in_bytes": 0,
    "max_unsafe_auto_id_timestamp": -1,
    "file_sizes": { }
    },
    "translog": {
    "operations": 0,
    "size_in_bytes": 165,
    "uncommitted_operations": 0,
    "uncommitted_size_in_bytes": 165,
    "earliest_last_modified_age": 2158856014
    },
    "request_cache": {
    "memory_size_in_bytes": 4462104,
    "evictions": 0,
    "hit_count": 2608,
    "miss_count": 11637
    },
    "recovery": {
    "current_as_source": 0,
    "current_as_target": 0,
    "throttle_time_in_millis": 0
    },
    "off_heap_cache": {
    "capacity": 0,
    "entry_count": 0,
    "free": 0,
    "hit_count": 0,
    "miss_count": 0
    }
    },
    "total": { "docs": { "count": 260099692,"deleted": 0},"store": { "size_in_bytes": 107354528230,"total_data_set_size_in_bytes": 107354528230,"reserved_in_bytes": 0},"indexing": { "index_total": 260099692,"index_time_in_millis": 97592785,"index_current": 0,"index_failed": 0,"delete_total": 0,"delete_time_in_millis": 0,"delete_current": 0,"noop_update_total": 0,"is_throttled": false,"throttle_time_in_millis": 0},"get": { "total": 0,"time_in_millis": 0,"exists_total": 0,"exists_time_in_millis": 0,"missing_total": 0,"missing_time_in_millis": 0,"current": 0},"search": { "open_contexts": 0,"query_total": 111243,"query_time_in_millis": 3014736,"query_current": 0,"fetch_total": 45942,"fetch_time_in_millis": 40361,"fetch_current": 0,"scroll_total": 11277,"scroll_time_in_millis": 1325170,"scroll_current": 0,"suggest_total": 0,"suggest_time_in_millis": 0,"suggest_current": 0},"merges": { "current": 0,"current_docs": 0,"current_size_in_bytes": 0,"total": 991721,"total_time_in_millis": 187915036,"total_docs": 3285223197,"total_size_in_bytes": 2369785580090,"total_stopped_time_in_millis": 0,"total_throttled_time_in_millis": 60699206,"total_auto_throttle_in_bytes": 31457280},"refresh": { "total": 8940217,"total_time_in_millis": 141622410,"external_total": 8939057,"external_total_time_in_millis": 146605191,"listeners": 0},"flush": { "total": 1145,"periodic": 1139,"total_time_in_millis": 359667},"warmer": { "current": 0,"total": 8939051,"total_time_in_millis": 1372032},"query_cache": { "memory_size_in_bytes": 1624016,"total_count": 2370029,"hit_count": 595124,"miss_count": 1774905,"cache_size": 62,"cache_count": 69680,"evictions": 69618},"fielddata": { "memory_size_in_bytes": 3869968,"evictions": 0},"completion": { "size_in_bytes": 0},"segments": { "count": 191,"memory_in_bytes": 3714028,"terms_memory_in_bytes": 2804576,"stored_fields_memory_in_bytes": 186552,"term_vectors_memory_in_bytes": 0,"norms_memory_in_bytes": 0,"points_memory_in_bytes": 0,"doc_values_memory_in_bytes": 722900,"index_writer_memory_in_bytes": 0,"version_map_memory_in_bytes": 0,"fixed_bit_set_memory_in_bytes": 0,"max_unsafe_auto_id_timestamp": 1676724675265,"file_sizes": { }},"translog": { "operations": 0,"size_in_bytes": 330,"uncommitted_operations": 0,"uncommitted_size_in_bytes": 330,"earliest_last_modified_age": 2158856014},"request_cache": { "memory_size_in_bytes": 8273832,"evictions": 0,"hit_count": 5169,"miss_count": 23310},"recovery": { "current_as_source": 0,"current_as_target": 0,"throttle_time_in_millis": 0},"off_heap_cache": { "capacity": 0,"entry_count": 0,"free": 0,"hit_count": 0,"miss_count": 0}}
    }
    

    Elasticsearch是一个分布式搜索和分析引擎,分片是它的核心概念之一。简单来说,分片是将数据拆分成更小的部分,以便在不同的节点上进行存储和处理,从而提高系统的性能和可扩展性。

    在Elasticsearch中,每个索引都可以被分成多个分片,这些分片可以分布在不同的节点上。每个分片都是一个完整的Lucene索引,可以独立地进行搜索和索引操作。当一个查询被发送到Elasticsearch集群时,查询将被分发到每个相关分片上,分片返回结果并汇总到一个单一的结果集中。

    分片对于Elasticsearch的可扩展性非常重要。当需要处理更大的数据集时,可以通过增加节点和分片来提高系统的性能和吞吐量。但是,分片的过多也会带来一些问题,如增加了复杂性和管理成本,以及可能会导致分片之间的数据不一致性。因此,在设计分片时,需要权衡系统的需求和限制,以确保系统的可靠性和性能。

    相关文章

      网友评论

          本文标题:ElasticSearch 索引&分片&文档概念

          本文链接:https://www.haomeiwen.com/subject/kiyrddtx.html