我最近在 Elasticsearch 的攝取管道中添加了一個 GeoIP 處理器。這很有效，并向新攝取的檔案添加了新欄位。我想通過對索引執行 _update_by_query 將 GeoIP 欄位添加到舊資料中，但是，它似乎不接受“處理器”作為引數。
我想做的是這樣的：
POST my_index*/_update_by_query
{
"refresh": true,
"processors": [
{
"geoip" : {
"field": "doc['client_ip']",
"target_field" : "geo",
"database_file" : "GeoLite2-City.mmdb",
"properties":["continent_name", "country_iso_code", "country_name", "city_name", "timezone", "location"]
}
}
],
"script": {
"day_of_week": {
"type": "long",
"script": "emit(doc['@timestamp'].value.withZoneSameInstant(ZoneId.of(doc['geo.timezone'])).getDayOfWeek().getValue())"
},
"hour_of_day": {
"type": "long",
"script": "emit(doc['@timestamp'].value.withZoneSameInstant(ZoneId.of(doc['geo.timezone'])).getHour())"
},
"office_hours": {
"script": "if (doc['day_of_week'].value< 6 && doc['day_of_week'].value > 0) {if (doc['hour_of_day'].value> 7 && doc['hour_of_day'].value<19) {return 1;} else {return -1;} } else {return -1;}"
}
}
}
我收到以下錯誤：
{
"error" : {
"root_cause" : [
{
"type" : "parse_exception",
"reason" : "Expected one of [source] or [id] fields, but found none"
}
],
"type" : "parse_exception",
"reason" : "Expected one of [source] or [id] fields, but found none"
},
"status" : 400
}
uj5u.com熱心網友回復：
由于您已準備好攝取管道，您只需在對_update_by_query端點的呼叫中參考它，如下所示：
POST my_index*/_update_by_query?pipeline=my-pipeline
^
|
add this
轉載請註明出處，本文鏈接：https://www.uj5u.com/qianduan/363503.html
下一篇：為什么過濾器不適用于彈性搜索？