美文网首页ELK漫漫之路
logstash调用模板问题Failed to install

logstash调用模板问题Failed to install

作者: 续哥儿 | 来源:发表于2018-07-19 14:39 被阅读0次

    调用模板的时候报了这个错误
    为什么要使用模板呢,是因为我解析出来的filed传过去通通变成了text。

    ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://192.168.220.131:9200/_template/playerlogin'"
    

    通过直接插入模板发现

    
    {
     "template" : "nuan-*",
      "mappings" : {
      "nuan4": {"numeric_detection": true},
      "properties": {
        "IP": {"type": "ip"},
        "geoip":{
          "properties": {
            "location": {
              "type": "geo_point"
                         }
                      }
                   }
               }
           }
    }
    得出结果:
    {
      "error": {
        "root_cause": [
          {
            "type": "mapper_parsing_exception",
            "reason": "Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]"
          }
        ],
        "type": "mapper_parsing_exception",
        "reason": "Failed to parse mapping [properties]: Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]",
        "caused_by": {
          "type": "mapper_parsing_exception",
          "reason": "Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]"
        }
      },
      "status": 400
    }
    

    从这里得到了解释

    https://stackoverflow.com/questions/42385407/mapping-definition-for-location-has-unsupported-parameters-geohash-true

    继续报错

    reason": "Root mapping definition has unsupported parameters:  [IP : {type=ip}]
    

    最后通过这种方式解决了,没有开启数字检测,因为开启数值检测之后很麻烦,第一次传过来的是数字的话就会判断为long类型,

    {
     "template" : "xxxx",
      "mappings" : {
        "_default_" : {
      "properties": {
        "IP": {"type": "ip"},
        "geoip":{
          "properties": {
            "location": {
              "type": "geo_point"
            }
          }
        }
        }
       }
      }
     }
    

    6.0.x已经弃用了default 很奇怪-----探索
    再补充下再

        mutate {
                convert => { "[geoip][coordinates]" => "float" #转化经纬度的值为浮点数
                 "[geoip][location]" => "float"
                 "IP" => "ip"
                 convert => ["[geoip][location]","geo_point"]
                   }
                   }
    
    

    再这里改不知道能不能成,我以前格式用错了一直报错~未尝试

    相关文章

      网友评论

        本文标题:logstash调用模板问题Failed to install

        本文链接:https://www.haomeiwen.com/subject/skpapftx.html