1.問題: html
1. 在Elasticsearch中對 text 類型的字段進行聚合,報異常:java
腳本調用: nginx
GET /logstash-jsy/nginx-access/_search
{
"aggs": {
"all_interests": {
"terms": { "field": "geoip.city_name" }
}
}
}
app
java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on [geoip.city_name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
at org.elasticsearch.index.mapper.TextFieldMapper$TextFieldType.fielddataBuilder(TextFieldMapper.java:336)elasticsearch
2. 緣由, 默認 Elasticsearch 對 text 類型的字段是不可聚合的,基本類型可聚合ide
3. 解決: ui
a. 設置 Fielddata = true
PUT logstash-jsy/_mapping/nginx-access/
{
"properties": {
"geoip.city_name": {
"type": "text",
"fielddata": true
}
}
}
b. 若是 Fielddata = true 沒法解決, 使用使用keyword
查看你索引信息字段是不是這種多映射, req_url 字段既映射了 text , 又映射了 keyword
"req_url": {this
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}url
}
若是是:
https://www.elastic.co/guide/en/elasticsearch/reference/5.4/fielddata.html#before-enabling-fielddata
Use the my_field.keyword field for aggregations, sorting, or in scripts.
即: 字段.keyword
GET /logstash-jsy/nginx-access/_search
{
"aggs": {
"all_interests": {
"terms": { "field": "geoip.city_name.keyword" }
}
}
}spa
TermsAggregationBuilder teamAgg = AggregationBuilders.terms("cityName_count")
.field("geoip.country_name.keyword").size(15);
searchResponse = elasticsearchConfig.getObject().prepareSearch(EsConstant.INDEX_NAME)
.setTypes(EsConstant.TYPE_NAME).setQuery(null).addAggregation(teamAgg).setSize(0).execute()
.actionGet();
c. 若是還沒法解決
http://www.cnblogs.com/Creator/p/3722408.html
https://elasticsearch.cn/question/2031?notification_id=14626&comment_unfold=question