将对象作为嵌套对象导入到elasticsearch

xdnvmnnf 于 2021-06-13 发布在 ElasticSearch

关注(0)|答案(1)|浏览(391)

我用json记录了数千条聚合数据：

{
  "count": 25,
  "domain": "domain.tld",
  "geoips": {
    "AU": 5,
    "NZ": 20
  },
  "ips": {
    "1.2.3.4": 5,
    "1.2.3.5": 1,
    "1.2.3.6": 1,
    "1.2.3.7": 1,
    "1.2.3.8": 1,
    "1.2.3.9": 9,
    "1.2.3.10": 7
  },
  "subdomains": {
    "a.domain.tld": 1,
    "b.domain.tld": 1,
    "c.domain.tld": 1,
    "domain.tld": 22
  },
  "tld": "tld",
  "types": {
    "1": 3,
    "43": 22
  }
}

我在es上有Map：

"mappings": {
    "properties": {
      "count": {
        "type": "long"
      },
      "domain": {
        "type": "keyword"
      },
      "ips": {
        "type": "nested",
        "properties": {
          "key": {
            "type": "keyword"
          },
          "val": {
            "type": "long"
          }
        }
      },
      "geoips": {
        "type": "nested",
        "properties": {
          "key": {
            "type": "keyword"
          },
          "val": {
            "type": "long"
          }
        }
      },
      "subdomains": {
        "type": "nested",
        "properties": {
          "key": {
            "type": "keyword"
          },
          "val": {
            "type": "long"
          }
        }
      },
      "tld": {
        "type": "keyword"
      },
      "types": {
        "type": "nested",
        "properties": {
          "key": {
            "type": "keyword"
          },
          "val": {
            "type": "long"
          }
        }
      }
    }
  }

有什么简单的方法可以将这些线作为嵌套对象导入es吗？如果我使用批量插入而不进行修改，es将通过为每个ip/subdomain/geoip添加一个新字段来修改Map，而不是将其添加为简单的key/val对象。
或者只有一种方法是重新生成json到key/val嵌套字段？

elasticsearch JSON Nested

来源：https://stackoverflow.com/questions/65182374/import-json-with-objects-as-nested-to-elastic-search

1条答案

按热度按时间

euoag5mw1#

您的Map已经非常好了，但是数据不适合，因为 nested 数据类型需要一个对象数组，而不是单个对象。因此，您需要将嵌套对象转换为键值对数组，如下所示：

...
  "ips": [
    {
      "key": "1.2.3.4",
      "val": 5
    },
    {
      "key": "1.2.3.5",
      "val": 1
    },
    ...
  ],
  "subdomains": [
    {
      "key": "a.domain.tld",
      "val": 1
    },
    {
      "key": "b.domain.tld",
      "val": 1
    },
    ...
  ]
  ...

赞(0）回复(0）举报 2021-06-14

我来回答

将对象作为嵌套对象导入到elasticsearch

1条答案

相关问题

热门标签

最新问答