批量 API:格式错误的操作/元数据行 [3]，预期START_OBJECT但已找到 [VALUE_STRING]

Question

使用 Elasticsearch 5.5，在发布此批量请求时出现以下错误，无法找出请求出了什么问题。

"type": "illegal_argument_exception",
"reason": "Malformed action/metadata line [3], expected START_OBJECT but found [VALUE_STRING]"

发布 http://localhost:9200/access_log_index/access_log/_bulk

{ "index":{ "_id":11} }
{  
"id":11,
"tenant_id":682,
"tenant_name":"kcc",
"user.user_name":"k0772251",
"access_date":"20170821",
"access_time":"02:41:44.123+01:30",
"operation_type":"launch_service",
"remote_host":"qlsso.quicklaunchsso.com",
"user_agent":"Mozilla/5.0 (Linux; Android 7.0; LGLS775 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36",
"browser":"",
"device":"",
"application.application_id":1846,
"application.application_name":"Desire2Learn",
"geoip.ip":"192.95.18.163",
"geoip.country_code":"US",
"geoip.country_name":"United States",
"geoip.region_code":"NJ",
"geoip.region_name":"New Jersey",
"geoip.city":"Newark",
"geoip.zip_code":7102,
"geoip.time_zone":"America/New_York",
"geoip.latitude":40.7355,
"geoip.longitude":-74.1741,
"geoip.metro_code":501
}
{ "index":{"_id":12} }
{  
"id":12,
"tenant_id":682,
"tenant_name":"kcc",
"user.user_name":"k0772251",
"access_date":"20170821",
"access_time":"02:50:44.123+01:30",
"operation_type":"launch_service",
"remote_host":"qlsso.quicklaunchsso.com",
"user_agent":"Mozilla/5.0 (Linux; Android 7.0; LGLS775 Build/NRD90U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36",
"browser":"",
"device":"",
"application.application_id":2341,
"application.application_name":"Gmail",
"geoip.ip":"192.95.18.163",
"geoip.country_code":"US",
"geoip.country_name":"United States",
"geoip.region_code":"NJ",
"geoip.region_name":"New Jersey",
"geoip.city":"Newark",
"geoip.zip_code":7102,
"geoip.time_zone":"America/New_York",
"geoip.latitude":40.7355,
"geoip.longitude":-74.1741,
"geoip.metro_code":501
}

Answer 1

您的资源对象必须在一行中指定，如下所示

post /test322/type/_bulk
{ "index": {} }
{ "name": "Test1", "data": "This is my test data" }
{ "index": {} }
{ "name": "Test2", "data": "This is my test data2" }

我知道这似乎非常愚蠢和不直观，因为当您使用 PUT 或 POST 创建资源以进行非批量操作时，资源不必在一行上。

Answer 2

以下行的格式对我非常有效：操作、元数据、资源

注意：应CREATE操作以将资源添加到数据集，并且资源应内联写入，而不是新行。

POST http://localhost:9200/access_log_index/access_log/_bulk
{ "create" : { "_index" : "test", "_type" : "_doc", "_id" : "11" } }
{  "id":11, "tenant_id":682 , ... }

Answer 3

您需要遵循批量格式才能成功执行此操作。 它需要以下 JSON 结构：

action_and_meta_datan
optional_sourcen
action_and_meta_datan
optional_sourcen
....
action_and_meta_datan
optional_sourcen

有关进一步参考，请参阅此链接 https://www.elastic.co/guide/en/elasticsearch/reference/6.2/docs-bulk.html

Answer 4

我在将数据集推送到弹性搜索之前操作数据集时出现以下错误(有时在无服务器环境中您无法确定收到的事件的顺序(

{
"type": "illegal_argument_exception",
"reason": "Malformed action/metadata line [1], expected START_OBJECT or END_OBJECT but found [VALUE_BOOLEAN]"
}

当您修改弹性搜索批量 API 预期的事件序列时，会发生这种情况。 就像，当你使用'doc_as_upsert': true时，你应该在b中有数据

。

{
"update": {
"_index": "index_name",
"_id": "id1234"
}
}
,
{
"doc_as_upsert": true,
"doc": {
"id": "id1234",
...otherFields
}
}

在这种情况下，您不能跳过更新对象。

我希望这对那些在数据集进入 ES 之前操纵数据集的人有所帮助