logstash调用模板问题Failed to install template（geo_ip）

2023年6月20日 863次阅读 来源: 续哥儿

调用模板的时候报了这个错误
为什么要使用模板呢，是因为我解析出来的filed传过去通通变成了text。

ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Got response code '400' contacting Elasticsearch at URL 'http://192.168.220.131:9200/_template/playerlogin'"

通过直接插入模板发现


{
 "template" : "nuan-*",
  "mappings" : {
  "nuan4": {"numeric_detection": true},
  "properties": {
    "IP": {"type": "ip"},
    "geoip":{
      "properties": {
        "location": {
          "type": "geo_point"
                     }
                  }
               }
           }
       }
}
得出结果：
{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "Failed to parse mapping [properties]: Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]",
    "caused_by": {
      "type": "mapper_parsing_exception",
      "reason": "Root mapping definition has unsupported parameters:  [geoip : {properties={location={type=geo_point}}}] [IP : {type=ip}]"
    }
  },
  "status": 400
}

从这里得到了解释

https://stackoverflow.com/questions/42385407/mapping-definition-for-location-has-unsupported-parameters-geohash-true

继续报错

reason": "Root mapping definition has unsupported parameters:  [IP : {type=ip}]

最后通过这种方式解决了，没有开启数字检测，因为开启数值检测之后很麻烦，第一次传过来的是数字的话就会判断为long类型，

{
 "template" : "xxxx",
  "mappings" : {
    "_default_" : {
  "properties": {
    "IP": {"type": "ip"},
    "geoip":{
      "properties": {
        "location": {
          "type": "geo_point"
        }
      }
    }
    }
   }
  }
 }

6.0.x已经弃用了default 很奇怪—–探索
再补充下再

    mutate {
            convert => { "[geoip][coordinates]" => "float" #转化经纬度的值为浮点数
             "[geoip][location]" => "float"
             "IP" => "ip"
             convert => ["[geoip][location]","geo_point"]
               }
               }

再这里改不知道能不能成，我以前格式用错了一直报错~未尝试

    原文作者：续哥儿
    原文地址: https://www.jianshu.com/p/8c2cae98e01f
    本文转自网络文章，转载此文章仅为分享知识，如有侵权，请联系博主进行删除。
点赞