Question

这是 basic_data(example) 输出值

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "hello",
          "@timestamp" : "2021-05-13T02:50:05.962Z"
        },
      {
        "_index" : "0513_final_test_instgram",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "host" : "DESKTOP-7MDCA36",
          "path" : "C:/python_file/20210513_114123_instargram.csv",
          "@version" : "1",
          "message" : "python,
          "@timestamp" : "2021-05-13T02:50:05.947Z"
        }

首先，在各种字段值中，only message values have been extracted.（在代码示例下）

GET 0513_final_test_instgram/_search?_source=message&filter_path=hits.hits._source
{
  "hits" : {
    "hits" : [
      {
        "_source" : {
          "message" : "hello"
        }
      },
      {
        "_source" : {
          "message" : "python"
        }

我了解了存储新索引的 reindex。

https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html

但是，我看文档也不知道。

0513 尝试代码

POST _reindex
{
  "source": {
    "index": "0513_final_test_instgram"
  },
  "dest": {
    "index": "new_data_index"
  }
}

<块引用>

如何使用 reindex 将仅提取消息值的数据存储在新索引中？

更新评论尝试

output

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 163,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "6uShY3kBEkIlakOYovrR",
        "_score" : 1.0,
        "_source" : {
          "message" : "hello"
        }
      },
      {
        "_index" : "new_data_index",
        "_type" : "_doc",
        "_id" : "EeShY3kBEkIlakOYovvm",
        "_score" : 1.0,
        "_source" : {
          "message" : "python"
        }
      }

Answer 1

您只需要specify which fields您想重新索引到新索引中：

{
  "source": {
    "index": "0513_final_test_instgram",
    "_source": ["message"]
  },
  "dest": {
    "index": "new_data_index"
  }
}

如何通过过滤器将重新索引应用于新数据值？

1 个答案: