Elasticsearch-FAQ

2021-06-17ELK点击

1、elasticsearch空index搜索排序报错问题( No mapping found for [Time] in order to sort on)

查看对应的 index 后，发现这个 index 没有数据，创建的时候是有默认的 _default_ mapping 结构的。

curl -XPOST "http://172.26.137.58:9200/events-history-imp_19_iscs_he-2021042504/_search" -d '{"from":0,"size":51,"query":{"bool":{"filter":[{"range":{"Time":{"from":1617552000000000000,"to":1623686400999000000,"include_lower":true,"include_upper":true,"boost":1}}},{"bool":{"disable_coord":false,"adjust_pure_negative":true,"boost":1}}],"disable_coord":false,"adjust_pure_negative":true,"boost":1}},"sort":[{"Time":{"order":"asc", "unmapped_type" : "long"}},{"EventId":{"order":"asc", "unmapped_type": "keyword"}}]}'

查看资料后，知道原因：

ES创建 index 后,虽然指定了 _defult_ mapping 但根本没有初始化，在search查询查询排序时候 sort 的字段不知道什么类型，就会导致上述错误。

解决办法：

在 sort 的字段属性里面，添加 unmapped_type 属性。

参考代码

SearchRequestBuilder srb = client.prepareSearch(indexName)
    .setTypes(args.getIndexTypes())
    .setSearchType(SearchType.QUERY_THEN_FETCH)
    .setQuery(queryBuilder)
    .setFrom(args.getFrom())
    .setSize(args.getSize());

srb.addSort(SortBuilders.fieldSort("Time")
                        .order("asc").unmappedType("long"));

参考博客：

https://blog.csdn.net/caojianwei1992/article/details/88971733

https://www.elastic.co/guide/en/elasticsearch/reference/5.6/search-request-sort.html

2、如何删除 cluster setting

参考：https://stackoverflow.com/questions/33520384/elasticsearch-how-to-delete-a-cluster-setting

# 可以通过分配空值来重置persistent或transient设置
# persistent: 持久设置
# transient: 临时设置，集群重启即清空失效
PUT /_cluster/settings
{
    "persistent" : {
        "indices.store.throttle.max_bytes_per_sec" : null
    }
}