弹性搜索--如何从现有领域中添加新字段和赋值

Question

我有一个弹性搜索指数如下，

 {
  "payment_transaction": {
    "mappings": {
      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date"
          }
        }
      }
    }
  }
}

我还需要添加另外三个字段(年、月、日)，.And需要从现有字段(created_date)中赋值。2016-11-22T22:20:21.000Z.是created_date的格式我该怎么做？弹性搜索版本为5.0。

Answer 1

所做的工作是使用映射的created_date选项将至字段复制到单独的文本字段。然后可以使用替换 char筛选器分析文本字段以提取年份、月份的日期，如下例所示：

示例：

put test 
{
    "settings": {
        "analysis": {
            "char_filter": {
                "year" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$1"
                },
                "month" : {
                    "type": "pattern_replace",
                    "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$2"
                },
                "day" : {
                    "type": "pattern_replace",
                       "pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
                    "replacement": "$3"
                }
            },
            "analyzer": {
                "year" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["year"]
                },
                "month" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["month"]
                },
                "day" : {

                    "tokenizer" : "keyword",
                    "char_filter" : ["day"]
                }

            }
        }
    }
}
put test/message_logs/_mapping
{


      "message_logs": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "changed_date": {
            "type": "date"
          },
          "created_date": {
            "type": "date",

            "copy_to" : ["year","month","day"]
          },
           "year": {
            "type": "text",
            "analyzer" : "year",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "month": {
                 "type": "text",
            "analyzer" : "month",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          },
          "day": {
               "type": "text",
            "analyzer" : "day",
            "search_analyzer":"keyword",
            "store" : true,
            "fielddata":true


          }
        }
      }


}

put test/message_logs/1 
{
    "created_date" : "2016-11-22T22:20:21.000Z"
}

post test/message_logs/_search
{
    "fielddata_fields": [
       "year",
       "month",
       "day"
    ]
}

结果：

    {
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1,
      "max_score": 1,
      "hits": [
         {
            "_index": "test",
            "_type": "message_logs",
            "_id": "1",
            "_score": 1,
            "_source": {
               "created_date": "2016-11-22T22:20:21.000Z"
            },
            "fields": {
               "month": [
                  "11"
               ],
               "year": [
                  "2016"
               ],
               "day": [
                  "22"
               ]
            }
         }
      ]
   }
}

fielddata不需要是true，仅为示例的目的而启用。