直通对象字段类型

编辑

直通对象扩展了对象的功能,允许访问其子字段而无需包含直通对象的名称作为前缀。例如

resp = client.indices.create(
    index="my-index-000001",
    mappings={
        "properties": {
            "attributes": {
                "type": "passthrough",
                "priority": 10,
                "properties": {
                    "id": {
                        "type": "keyword"
                    }
                }
            }
        }
    },
)
print(resp)

resp1 = client.index(
    index="my-index-000001",
    id="1",
    document={
        "attributes": {
            "id": "foo",
            "zone": 10
        }
    },
)
print(resp1)

resp2 = client.search(
    index="my-index-000001",
    query={
        "bool": {
            "must": [
                {
                    "match": {
                        "id": "foo"
                    }
                },
                {
                    "match": {
                        "zone": 10
                    }
                }
            ]
        }
    },
)
print(resp2)

resp3 = client.search(
    index="my-index-000001",
    query={
        "bool": {
            "must": [
                {
                    "match": {
                        "attributes.id": "foo"
                    }
                },
                {
                    "match": {
                        "attributes.zone": 10
                    }
                }
            ]
        }
    },
)
print(resp3)
const response = await client.indices.create({
  index: "my-index-000001",
  mappings: {
    properties: {
      attributes: {
        type: "passthrough",
        priority: 10,
        properties: {
          id: {
            type: "keyword",
          },
        },
      },
    },
  },
});
console.log(response);

const response1 = await client.index({
  index: "my-index-000001",
  id: 1,
  document: {
    attributes: {
      id: "foo",
      zone: 10,
    },
  },
});
console.log(response1);

const response2 = await client.search({
  index: "my-index-000001",
  query: {
    bool: {
      must: [
        {
          match: {
            id: "foo",
          },
        },
        {
          match: {
            zone: 10,
          },
        },
      ],
    },
  },
});
console.log(response2);

const response3 = await client.search({
  index: "my-index-000001",
  query: {
    bool: {
      must: [
        {
          match: {
            "attributes.id": "foo",
          },
        },
        {
          match: {
            "attributes.zone": 10,
          },
        },
      ],
    },
  },
});
console.log(response3);
PUT my-index-000001
{
  "mappings": {
    "properties": {
      "attributes": {
        "type": "passthrough", 
        "priority": 10,
        "properties": {
          "id": {
            "type": "keyword"
          }
        }
      }
    }
  }
}

PUT my-index-000001/_doc/1
{
  "attributes" : {  
    "id": "foo",
    "zone": 10
  }
}

GET my-index-000001/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "id": "foo" }},  
        { "match": { "zone": 10 }}
      ]
    }
  }
}

GET my-index-000001/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "attributes.id": "foo" }}, 
        { "match": { "attributes.zone": 10 }}
      ]
    }
  }
}

对象被定义为直通对象。它的优先级(必需)用于冲突解决。

对象内容像往常一样被索引,包括动态映射。

子字段可以在查询中被引用,就像它们在根级别定义一样。

子字段也可以被引用,包括对象名称作为前缀。

冲突解决

编辑

对于在不同作用域内定义的字段,可能会出现冲突的名称。

  1. 直通对象定义在与具有与直通对象子字段相同的名称的字段旁边,例如

    resp = client.index(
        index="my-index-000001",
        id="1",
        document={
            "attributes": {
                "id": "foo"
            },
            "id": "bar"
        },
    )
    print(resp)
    const response = await client.index({
      index: "my-index-000001",
      id: 1,
      document: {
        attributes: {
          id: "foo",
        },
        id: "bar",
      },
    });
    console.log(response);
    PUT my-index-000001/_doc/1
    {
      "attributes" : {
        "id": "foo"
      },
      "id": "bar"
    }

    在这种情况下,对id的引用指向根级别的字段,而字段attributes.id只能使用完整路径访问。

  2. 两个(或更多)直通对象在同一个对象内定义,并且包含具有相同名称的字段,例如

    resp = client.indices.create(
        index="my-index-000002",
        mappings={
            "properties": {
                "attributes": {
                    "type": "passthrough",
                    "priority": 10,
                    "properties": {
                        "id": {
                            "type": "keyword"
                        }
                    }
                },
                "resource.attributes": {
                    "type": "passthrough",
                    "priority": 20,
                    "properties": {
                        "id": {
                            "type": "keyword"
                        }
                    }
                }
            }
        },
    )
    print(resp)
    const response = await client.indices.create({
      index: "my-index-000002",
      mappings: {
        properties: {
          attributes: {
            type: "passthrough",
            priority: 10,
            properties: {
              id: {
                type: "keyword",
              },
            },
          },
          "resource.attributes": {
            type: "passthrough",
            priority: 20,
            properties: {
              id: {
                type: "keyword",
              },
            },
          },
        },
      },
    });
    console.log(response);
    PUT my-index-000002
    {
      "mappings": {
        "properties": {
          "attributes": {
            "type": "passthrough",
            "priority": 10,
            "properties": {
              "id": {
                "type": "keyword"
              }
            }
          },
          "resource.attributes": {
            "type": "passthrough",
            "priority": 20,
            "properties": {
              "id": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }

    在这种情况下,参数priority用于冲突解决,较高的值优先。在上面的示例中,resource.attributes的优先级高于attributes,因此对id的引用指向resource.attributes中的字段。attributes.id仍然可以使用其完整路径访问。

将子字段定义为时间序列维度

编辑

可以将直通字段配置为时间序列维度的容器。在这种情况下,所有子字段在底层都使用相同的参数进行注释,并且它们也包含在路由路径tsid计算中,从而简化了TSDS设置

resp = client.indices.put_index_template(
    name="my-metrics",
    index_patterns=[
        "metrics-mymetrics-*"
    ],
    priority=200,
    data_stream={},
    template={
        "settings": {
            "index.mode": "time_series"
        },
        "mappings": {
            "properties": {
                "attributes": {
                    "type": "passthrough",
                    "priority": 10,
                    "time_series_dimension": True,
                    "properties": {
                        "host.name": {
                            "type": "keyword"
                        }
                    }
                },
                "cpu": {
                    "type": "integer",
                    "time_series_metric": "counter"
                }
            }
        }
    },
)
print(resp)

resp1 = client.index(
    index="metrics-mymetrics-test",
    document={
        "@timestamp": "2020-01-01T00:00:00.000Z",
        "attributes": {
            "host.name": "foo",
            "zone": "bar"
        },
        "cpu": 10
    },
)
print(resp1)
const response = await client.indices.putIndexTemplate({
  name: "my-metrics",
  index_patterns: ["metrics-mymetrics-*"],
  priority: 200,
  data_stream: {},
  template: {
    settings: {
      "index.mode": "time_series",
    },
    mappings: {
      properties: {
        attributes: {
          type: "passthrough",
          priority: 10,
          time_series_dimension: true,
          properties: {
            "host.name": {
              type: "keyword",
            },
          },
        },
        cpu: {
          type: "integer",
          time_series_metric: "counter",
        },
      },
    },
  },
});
console.log(response);

const response1 = await client.index({
  index: "metrics-mymetrics-test",
  document: {
    "@timestamp": "2020-01-01T00:00:00.000Z",
    attributes: {
      "host.name": "foo",
      zone: "bar",
    },
    cpu: 10,
  },
});
console.log(response1);
PUT _index_template/my-metrics
{
  "index_patterns": ["metrics-mymetrics-*"],
  "priority": 200,
  "data_stream": { },
  "template": {
    "settings": {
      "index.mode": "time_series"
    },
    "mappings": {
      "properties": {
        "attributes": {
          "type": "passthrough",
          "priority": 10,
          "time_series_dimension": true,
          "properties": {
            "host.name": {
              "type": "keyword"
            }
          }
        },
        "cpu": {
          "type": "integer",
          "time_series_metric": "counter"
        }
      }
    }
  }
}

POST metrics-mymetrics-test/_doc
{
  "@timestamp": "2020-01-01T00:00:00.000Z",
  "attributes" : {
    "host.name": "foo",
    "zone": "bar"
  },
  "cpu": 10
}

在上面的示例中,attributes被定义为维度容器。其子字段host.name(静态)和zone(动态)包含在路由路径和tsid中,并且可以在查询中被引用,无需attributes.前缀。

子字段自动扁平化

编辑

直通字段默认对子字段应用自动扁平化,以减少动态映射冲突。因此,在直通字段内不允许任何子对象定义。

passthrough字段的参数

编辑

passthrough字段接受以下参数

priority

(必需)用于直通字段之间的命名冲突解决。值最大的字段获胜。接受非负整数。

time_series_dimension

是否将子字段视为时间序列维度。接受false(默认值)或true

dynamic

是否应将新的properties动态添加到现有对象中。接受true(默认值)、runtimefalsestrict

enabled

对象字段给定的 JSON 值是否应被解析和索引(true,默认值)或完全忽略(false)。

properties

对象中的字段,可以是任何数据类型,包括object。可以将新属性添加到现有对象中。

如果需要索引对象的数组而不是单个对象,请先阅读嵌套