elasticsearch開(kāi)發(fā)中data-streams使用解析

更新時(shí)間：2023年08月07日 14:46:28 作者：codecraft

這篇文章主要為大家介紹了elasticsearch開(kāi)發(fā)中data-streams使用解析,有需要的朋友可以借鑒參考下,希望能夠有所幫助,祝大家多多進(jìn)步,早日升職加薪

序

本文主要研究一下elasticsearch的data-streams

data-streams

主要特性

首先data streams是由一個(gè)或者多個(gè)自動(dòng)生成的隱藏索引組成的，它的格式為.ds-<data-stream>-<yyyy.MM.dd>-<generation>

示例.ds-web-server-logs-2099.03.07-000034，generation是一個(gè)6位的數(shù)字，默認(rèn)從000001開(kāi)始

必須包含@timestamp字段，映射為date或者date_nanos字段類(lèi)型，如果index template沒(méi)有定義類(lèi)型的話，則elasticsearch默認(rèn)將其定義為date類(lèi)型
讀請(qǐng)求會(huì)自動(dòng)路由到關(guān)聯(lián)到的所有索引，而寫(xiě)請(qǐng)求的話則是添加到最新的索引，舊的索引不支持添加數(shù)據(jù)
rollover會(huì)根據(jù)指定條件來(lái)創(chuàng)建新索引，一般是推薦使用ILM自動(dòng)取rollover

使用

創(chuàng)建mappings和settings

# Creates a component template for mappings
PUT _component_template/my-mappings
{
  "template": {
    "mappings": {
      "properties": {
        "@timestamp": {
          "type": "date",
          "format": "date_optional_time||epoch_millis"
        },
        "message": {
          "type": "wildcard"
        }
      }
    }
  },
  "_meta": {
    "description": "Mappings for @timestamp and message fields",
    "my-custom-meta-field": "More arbitrary metadata"
  }
}
# Creates a component template for index settings
PUT _component_template/my-settings
{
  "template": {
    "settings": {
      "index.lifecycle.name": "my-lifecycle-policy"
    }
  },
  "_meta": {
    "description": "Settings for ILM",
    "my-custom-meta-field": "More arbitrary metadata"
  }
}

主要是利用_component_template創(chuàng)建mappings和settings，方面下面創(chuàng)建index_template使用

創(chuàng)建index template

PUT _index_template/my-index-template
{
  "index_patterns": ["my-data-stream*"],
  "data_stream": { },
  "composed_of": [ "my-mappings", "my-settings" ],
  "priority": 500,
  "_meta": {
    "description": "Template for my time series data",
    "my-custom-meta-field": "More arbitrary metadata"
  }
}

創(chuàng)建data stream

PUT /_data_stream/my-data-stream-1/

查詢data stream

GET /_data_stream/my-data-stream-1
{
    "data_streams": [
        {
            "name": "my-data-stream-1",
            "timestamp_field": {
                "name": "@timestamp"
            },
            "indices": [
                {
                    "index_name": ".ds-my-data-stream-1-2023.08.06-000001",
                    "index_uuid": "ByCb4bPGSEOXfVf3Txpiiw"
                }
            ],
            "generation": 1,
            "_meta": {
                "my-custom-meta-field": "More arbitrary metadata",
                "description": "Template for my time series data"
            },
            "status": "YELLOW",
            "template": "my-data-stream",
            "ilm_policy": "my-lifecycle-policy",
            "hidden": false,
            "system": false,
            "allow_custom_routing": false,
            "replicated": false
        }
    ]
}

創(chuàng)建數(shù)據(jù)

POST my-data-stream-1/_doc
{
  "@timestamp": "2099-05-06T16:21:15.000Z",
  "message": "192.0.2.42 - - [06/May/2099:16:21:15 +0000] \"GET /images/bg.jpg HTTP/1.0\" 200 24736"
}

返回

{
    "_index": ".ds-my-data-stream-1-2023.08.06-000001",
    "_id": "bHTfyIkBwVE4kI2xm5nL",
    "_version": 1,
    "result": "created",
    "_shards": {
        "total": 2,
        "successful": 1,
        "failed": 0
    },
    "_seq_no": 0,
    "_primary_term": 1
}

查詢索引數(shù)據(jù)

POST my-data-stream-1/_search
{ "query": { "match_all": {} } }

filebeat

filebeat默認(rèn)output到elasticsearch創(chuàng)建的就是data streams，如果不想使用其自動(dòng)加載的模版，則可以設(shè)置setup.template.enabled=false，那么創(chuàng)建的則是普通的index。

小結(jié)

elasticsearch7.9版本以xpack的形式推出了data streams，主要是針對(duì)持續(xù)產(chǎn)生的時(shí)間序列數(shù)據(jù)提供了一種更為簡(jiǎn)單的方式去對(duì)索引進(jìn)行數(shù)據(jù)切分和統(tǒng)一查詢的方式。

doc data-streams

以上就是elasticsearch開(kāi)發(fā)中data-streams使用解析的詳細(xì)內(nèi)容，更多關(guān)于elasticsearch data-streams的資料請(qǐng)關(guān)注腳本之家其它相關(guān)文章！

您可能感興趣的文章: