logstash输出到ElasticSearch服务端自定义配置模板，部分字段映射类型重复

Question

软件版本

logstash版本6.7.1
elasticsearch版本6.6.0

问题描述

es服务端创建索引模板

PUT /_template/xgservice-seaslog
{
    "index_patterns":"xgservice-seaslog",
    "order":1,
    "settings":{
        "index.refresh_interval":"2s"
    },
    "mappings":{
        "doc":{
            "properties":{
                "date":{
                    "format":"yyyy-MM-dd HH:mm:ss",
                    "type":"date"
                },
                "process_id":{
                    "type":"integer"
                },
                "domain_url":{
                    "type":"keyword"
                },
                "method":{
                    "type":"keyword"
                },
                "level":{
                    "type":"keyword"
                },
                "client_ip":{
                    "type":"ip"
                },
                "request_id":{
                    "type":"keyword"
                },
                "request_uri":{
                    "type":"keyword"
                },
                "info":{
                    "type":"text",
                    "fields":{
                        "en":{
                            "analyzer":"english",
                            "type":"text"
                        },
                        "cn":{
                            "analyzer":"ik_smart",
                            "type":"text"
                        }
                    }
                }
            }
        }
    }
}

logstash输出到ElasticSearch后，查看mapping发现部分字段重复

{
  "xgservice-seaslog" : {
    "mappings" : {
      "doc" : {
        "properties" : {
          "client_ip" : {
            "type" : "ip"
          },
          "date" : {
            "type" : "date",
            "format" : "yyyy-MM-dd HH:mm:ss"
          },
          "domain_url" : {
            "type" : "keyword"
          },
          "info" : {
            "type" : "text",
            "fields" : {
              "cn" : {
                "type" : "text",
                "analyzer" : "ik_smart"
              },
              "en" : {
                "type" : "text",
                "analyzer" : "english"
              }
            }
          },
          "level" : {
            "type" : "keyword"
          },
          "method" : {
            "type" : "keyword"
          },
          "process_id" : {
            "type" : "integer"
          },
          "process_id " : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "request_id" : {
            "type" : "keyword"
          },
          "request_id " : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "request_uri" : {
            "type" : "keyword"
          }
        }
      }
    }
  }
}

如下图字段：

process_id是数值类型，比如3043，而request_id是文本类型，比如5ca386dcc4d48

Answer 1

估计是定义的request_id为keyword，实际logstash输出字段是数字类型（不是文本）？重复的elasticsearch自动生成的