Я пытаюсь настроить следующее сопоставление для ES 6.6.0, но я получаю эту ошибку; Caused by: org.elasticsearch.index.mapper.MapperParsingException: Root mapping definition has unsupported parameters: [_timestamp : {enabled=true}]
Я думаю, что это изначально ES2, но я не уверен. Были некоторые проблемы с неправильными типами, поэтому я изменил string на keyword для свойств ActionName и UserName.
{
"template": "audit_*",
"aliases": {
"{index}_read": {},
"{index}_write": {},
"{index}_verify": {}
},
"settings": {
"index": {
"number_of_shards": 12,
"number_of_replicas": 2
},
"analysis": {
"analyzer": {
"str_search_analyzer": {
"tokenizer": "keyword",
"filter": [
"lowercase",
"substring"
]
},
"str_index_analyzer": {
"tokenizer": "keyword",
"filter": [
"lowercase",
"substring"
]
},
"lwhitespace": {
"tokenizer": "whitespace",
"filter": [
"lowercase"
]
}
},
"filter": {
"substring": {
"type": "nGram",
"min_gram": 1,
"max_gram": 20
}
}
}
},
"mappings": {
"audit": {
"dynamic_templates": [
{
"raw": {
"match_pattern": "regex",
"path_match": "Details\\.auditElement\\..*",
"mapping": {
"type": "string",
"fields": {
"Raw": {
"analyzer": "lwhitespace",
"type": "string"
}
}
},
"match_mapping_type": "string"
}
},
{
"newvalue": {
"match_pattern": "regex",
"path_match": ".*\\.newValue$",
"mapping": {
"type": "string",
"fields": {
"Raw": {
"analyzer": "lwhitespace",
"type": "string"
}
}
}
}
},
{
"oldvalue": {
"match_pattern": "regex",
"path_match": ".*\\.oldValue$",
"mapping": {
"type": "string",
"fields": {
"Raw": {
"analyzer": "lwhitespace",
"type": "string"
}
}
}
}
},
{
"analytics_text": {
"match_pattern": "regex",
"path_match": ".*\\.#text$",
"mapping": {
"type": "string",
"fields": {
"Raw": {
"analyzer": "lwhitespace",
"type": "string"
}
}
}
}
}
],
"_timestamp": {
"enabled": true
},
"_size": {
"enabled": true
},
"properties": {
"ActionName": {
"type": "keyword",
"index": true
},
"TimeStamp": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"UserName": {
"type": "keyword",
"index": true
}
}
}
}
}