（转）es进行聚合操作时提示Fielddata is disabled on text fields by default

根据es官网的文档执行

?

1 2 3 4 5 6 7 8

GET /megacorp/employee/_search {   "aggs": {     "all_interests": {       "terms": { "field": "interests" }     }   } }

这个例子时，报错

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

{   "error": {     "root_cause": [       {         "type": "illegal_argument_exception",         "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [interests] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."       }     ],     "type": "search_phase_execution_exception",     "reason": "all shards failed",     "phase": "query",     "grouped": true,     "failed_shards": [       {         "shard": 0,         "index": "megacorp",         "node": "-Md3f007Q3G6HtdnkXoRiA",         "reason": {           "type": "illegal_argument_exception",           "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [interests] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."         }       }     ],     "caused_by": {       "type": "illegal_argument_exception",       "reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [interests] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."     }   },   "status": 400 }

搜了一下应该是5.x后对排序，聚合这些操作用单独的数据结构(fielddata)缓存到内存里了，需要单独开启，官方解释在此fielddata

简单来说就是在聚合前执行如下操作

?

1 2 3 4 5 6 7 8 9

PUT megacorp/_mapping/employee/ {   "properties": {     "interests": {       "type":     "text",       "fielddata": true     }   } }

PS:执行上面操作前，先GET megacorp/_mapping/employee/查看mapping结构，然后执行上述命令，贴一下我聚合logstash读取tomcat.log到es里cilentip字段的步骤：

1.首先先GET logstash-apacheaccesslog*/_mapping/logs/查看mapping结构

PUT logstash-apacheaccesslog*/_mapping/logs/

{

　　"properties": {
　　   "verb": {
　　　　"type": "text",
　　　　"norms": false,
　　　　"fielddata": true
 　　　 }
　　}

}

2、对clientip字段进行聚合

转自：http://blog.csdn.net/u011403655/article/details/71107415