错误：[mapper_parsing_exception] 根映射定义具有不支持的参数："Elasticserach"

Question

我正在尝试将SendGrid事件发送到kibana，我收到以下错误

[root@elasticsearch-7 /]# sendgrid-event-logger
Installing template..
ERROR:[mapper_parsing_exception] Root mapping definition has unsupported parameters:  [log : {dynamic_templates=[{string_fields={mapping={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={raw={index=not_analyzed, type=string}}}, match_mapping_type=string, match=*}}], properties={date={format=yyyy.MM.dd, type=date}, sg_message_id={index=not_analyzed, type=string}, ip={index=not_analyzed, type=ip}, sg_event_id={index=not_analyzed, type=string}, event={index=not_analyzed, type=string}, email={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={domain={analyzer=email_domain_analyzer, index=analyzed, type=string}, raw={index=not_analyzed, type=string}}}, timestamp={format=epoch_second, type=date}}}] :: {"path":"/_template/sendgrid_template","query":{},"body":"{"template":"mail-*","settings":{"number_of_shards":1,"index":{"analysis":{"tokenizer":{"email_domain_tokenizer":{"type":"pattern","pattern":"^.+@","group":-1}},"analyzer":{"email_domain_analyzer":{"type":"custom","tokenizer":"email_domain_tokenizer"}}}}},"mappings":{"log":{"dynamic_templates":[{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"type":"string","index":"analyzed","omit_norms":true,"fielddata":{"format":"disabled"},"fields":{"raw":{"type":"string","index":"not_analyzed"}}}}}],"properties":{"email":{"type":"string","index":"analyzed","omit_norms":true,"fielddata":{"format":"disabled"},"fields":{"raw":{"type":"string","index":"not_analyzed"},"domain":{"type":"string","index":"analyzed","analyzer":"email_domain_analyzer"}}},"timestamp":{"type":"date","format":"epoch_second"},"date":{"type":"date","format":"yyyy.MM.dd"},"event":{"type":"string","index":"not_analyzed"},"ip":{"type":"ip","index":"not_analyzed"},"sg_event_id":{"type":"string","index":"not_analyzed"},"sg_message_id":{"type":"string","index":"not_analyzed"}}}},"aliases":{"mail":{}}}","statusCode":400,"response":"{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters:  [log : {dynamic_templates=[{string_fields={mapping={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={raw={index=not_analyzed, type=string}}}, match_mapping_type=string, match=*}}], properties={date={format=yyyy.MM.dd, type=date}, sg_message_id={index=not_analyzed, type=string}, ip={index=not_analyzed, type=ip}, sg_event_id={index=not_analyzed, type=string}, event={index=not_analyzed, type=string}, email={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={domain={analyzer=email_domain_analyzer, index=analyzed, type=string}, raw={index=not_analyzed, type=string}}}, timestamp={format=epoch_second, type=date}}}]"}],"type":"mapper_parsing_exception","reason":"Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters:  [log : {dynamic_templates=[{string_fields={mapping={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={raw={index=not_analyzed, type=string}}}, match_mapping_type=string, match=*}}], properties={date={format=yyyy.MM.dd, type=date}, sg_message_id={index=not_analyzed, type=string}, ip={index=not_analyzed, type=ip}, sg_event_id={index=not_analyzed, type=string}, event={index=not_analyzed, type=string}, email={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={domain={analyzer=email_domain_analyzer, index=analyzed, type=string}, raw={index=not_analyzed, type=string}}}, timestamp={format=epoch_second, type=date}}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Root mapping definition has unsupported parameters:  [log : {dynamic_templates=[{string_fields={mapping={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={raw={index=not_analyzed, type=string}}}, match_mapping_type=string, match=*}}], properties={date={format=yyyy.MM.dd, type=date}, sg_message_id={index=not_analyzed, type=string}, ip={index=not_analyzed, type=ip}, sg_event_id={index=not_analyzed, type=string}, event={index=not_analyzed, type=string}, email={fielddata={format=disabled}, index=analyzed, omit_norms=true, type=string, fields={domain={analyzer=email_domain_analyzer, index=analyzed, type=string}, raw={index=not_analyzed, type=string}}}, timestamp={format=epoch_second, type=date}}}]"}},"status":400}"}

Answer 1

看起来您正在运行ES 7，并且sendgrid事件记录器已经4年没有更新了。不再支持多个映射类型，默认映射类型现在命名为_doc，而sendgrid事件记录器使用名为log的自定义映射类型。因此，您需要进行以下三项更改，它应该会起作用。

1. 在lib/elasticsearch-template.json中，只需在第24行更改以下内容：

更换

"log"

带

"_doc"

2. 在lib/parser.js中，对第43行进行以下更改：

Raplase

_type: 'log'

带

_type: '_doc'

3. 在lib/server.js中，对第43行进行以下更改：

Raplase

type: 'log'

带

type: '_doc'

而且它应该工作