Kibana报告字段冲突，我该如何解决?

问题描述

在Kibana中，刷新索引模式后我注意到我的一个字段显示为conflicted.

In Kibana I've noticed after I did an Index Pattern refresh that my one field shows up as conflicted.

示例:

所以我知道这是因为Elastic Search在该字段中发现了不同类型的值，我该如何确定呢?这导致我的视​​觉效果破裂，因为它们无法处理冲突的字段.我该如何解决现有数据的这个问题?

So I understand that this is because Elastic Search found values in that field that are of different types, how can I determine that? It is causing my Visuals to break as they can't work with conflicting fields.How can I get around this problem for the existing data?

推荐答案

经过数小时的研究并浏览了Elastic文档，我终于找到了解决我问题的答案.

After many hours of playing around and going through the Elastic documentation I have finally found an answer to my problem.

在Elastic Search 5.1(我使用的版本)中，您可以为那些有问题的"特定索引重新编制索引.

In Elastic Search 5.1 (the version I used) you can re-index those specific Indexes that are "problematic".

您可以在Kibana中找到它，方法是单击Management> Index Patterns并查找显示为conflicted的字段.然后单击相应的铅笔图标以查看该字段的详细信息.在其中将显示不同字段类型下的索引.

You can find this in Kibana by clicking on Management > Index Patterns and looking for the field that shows up as conflicted. Then click on the corresponding pencil icon to look at the field's details. In there is will show the Indexes under the different field types.

我在Power-Shell中编写了一个脚本，该脚本通过指定问题索引"为我自动化，然后执行以下操作(假设您有问题的索引称为:log-20170101):

I wrote a script in Power-Shell that automated this for me by specifying the "problematic indexes" and then it does the following (let's assume your problematic index is called: log-20170101):

• 为log-20170101-1
创建映射
• 将log-20170101重新索引为log-20170101-1
• 删除log-20170101
• 为log-20170101
创建映射
• 将log-20170101-1重新索引为log-20170101
• 删除log-20170101-1

• Create a mapping for log-20170101-1
• Re-index log-20170101 to log-20170101-1
• Delete log-20170101
• Create a mapping for log-20170101
• Re-index log-20170101-1 to log-20170101
• Delete log-20170101-1

现在，当您在Kibana中刷新索引格式时，您会注意到该字段不再是conflicted.

Now when you Refresh your Index Patter in Kibana you will notice that the field is no longer conflicted.

您可以阅读以下内容:映射和重新索引

You can read up on: Mappings and Re-Indexing

请确保在下面指定新映射时，使用要查找的适当映射数据类型.

Make sure that when you specify your new mapping below, that you use the appropriate mapping data-types that you are looking for.

您可以通过查询Elastic API来获取现有映射:

You can get an existing mapping by querying the Elastic API with:

GET /_mapping/<your mapping name>

这是我在Power-Shell中执行的骨骼(示例)脚本，虽然非常基本，但我认为它可以提供帮助.

Here is a skeleton (sample) script I did in Power-Shell, it is very basic but I think it can help.

$index_list = @( 
    "log-20170101"
)

$index_list  | % {
    $index_name = $_

    $mapping_body = "
    {
        ""mappings"": {
            ""logevent"": {
                ""properties"": {
                    ""@timestamp"": {
                        ""type"": ""date""
                    },
                    ""correlationId"": {
                        ""type"": ""text"",
                        ""fields"": {
                            ""keyword"": {
                                ""type"": ""keyword"",
                                ""ignore_above"": 256
                            }
                        }
                    },
                    ""duration"": {
                        ""properties"": {
                            ""TotalMilliseconds"": {
                                ""type"": ""float""
                            }
                        }
                    }
                }
            }
        }
    }"

    $reindex_body = "{
        ""source"": {
            ""index"": ""$index_name""
        },
        ""dest"": {
            ""index"": ""$index_name-1""
        }
    }"

    $reindex_body_reverse = "{
        ""source"": {
            ""index"": ""$index_name-1""
        },
        ""dest"": {
            ""index"": ""$index_name""
        }
    }"

    Invoke-WebRequest -Uri http://elasticserver:9200/$index_name-1 -Method Put -Body $mapping_body
    Invoke-WebRequest -Uri http://elasticserver:9200/_reindex -Method Post -Body $reindex_body
    Invoke-WebRequest -Uri http://elasticserver:9200/$index_name -Method Delete
    Invoke-WebRequest -Uri http://elasticserver:9200/$index_name -Method Put -Body $mapping_body
    Invoke-WebRequest -Uri http://elasticserver:9200/_reindex -Method Post -Body $reindex_body_reverse
    Invoke-WebRequest -Uri http://elasticserver:9200/$index_name-1 -Method Delete
}

编辑

请参阅此帖子，了解如何设置默认映射，以尝试防止再次发生此问题.

See this post for how to setup default mappings going forward to try and prevent this problem from happening again.

这篇关于Kibana报告字段冲突，我该如何解决?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！