I am trying a simple new index on elasticsearch cloud with postman (elastic v.52)
But i cant see this index in my control panel.
I also received an "index not found" exception when I tried to send a delete request to the server.
I do not know what I'm doing wrong. Any ideas ?
Create index request:
Delete request:
I found the problem. It's index name uppercase problem. But elastic result don't explation this on exception details.
My wrong old index name "i_serdarTest"
New accepted index name "i_serdartest"
Related
geoip.location is of geo_point datatype when an event is sent from logstash to elasticsearch with default indexName. As geoip.location has geo_point datatype, i can view the plotting of location in maps in kibana as kibana looks for geo_point datatype for maps.
geoip.location becomes geoip.location.lat, geoip.location.lon with number datatype, when an event is sent from logstash to elasticsearch with modified indexName. Due to this i'm not able to view the plotting of location in maps in kibana.
i don't understand why elasticsearch would behave differently when i try to add data to a modifiedIndexName. is this a bug with elasticsearch?
For my usecase i need to use modified indexname, as i need new index for each day. The plan is to store the logs of a particular day in a single index. so, if there are 7 days then i need to have 7 indexes that contains logs of each day (new index should be created based on currentdate).
i searched around for solution, but i'm not able to comprehend and make it to work for me. Kindly help me out on this
Update (what i did after reading xeraa's answer?)
In the devtools in kibana,
GET _template/logstash - showed the allowed patterns in index_patterns property along with other properties
i included my pattern (dave*) inside index_patterns and triggered the PUT request. You have to pass the entire existing body content (which you would receive in the GET request) inside PUT request along with your required index_patterns, otherwise the default setting will disappear as the PUT api will replace whatever data you pass in the PUT body
PUT _template/logstash
{
...
"index_patterns": [
"logstash-*","dave*"
],
...
}
I'd guess that there is a template set for the default name, which isn't happening if you rename it.
Check with GET _template if any match your old index name and update the setting so that it also gets applied to the new one.
I am taking some courses on udemy on elastic search and trying to set up an elastic search project. I have gotten the bulk api to work and can successfully send batch data into an index on elastic search. But I am having trouble sending data without the bulk api. Because I have read on the elastic search docs that there is a 'false' analogy that a type is like a table in a database and an index is like a database. I decided for this project to create an index for each of the entities that I want to persist which is users and statistics. Therefore I have indices which are called statisitics and users. When I make the following request from postman
headers: Content-Type application/json
POST http://localhost:9200/users
with body:
{"id": 1, "name":"myname"}
I get an error
{"error":"Incorrect HTTP method for uri [/users] and method [POST],
allowed: [PUT, DELETE, GET, HEAD]","status":405}
How can I allow this http method?
Hello I had the same issue using PHP and JAVA, this happen simply because you must add the _type after the index name (described here) :
https://www.elastic.co/guide/en/elasticsearch/guide/current/index-doc.html
Try curl -XPOST http://localhost:9200/users/_admin or something similar ;)
See https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping.html
Since version 6.2, we need to use _doc for the type.
https://discuss.elastic.co/t/cant-use-doc-as-type-despite-it-being-declared-the-preferred-method/113837
https://www.elastic.co/guide/en/elasticsearch/reference/master/removal-of-types.html#_schedule_for_removal_of_mapping_types
In fact, when you say there is "no types" allowed in ElasticSearch, it is false (at least for versions up to 8.x). What is true is that there is only 1 type allowed for each index.
How to changing the field datatypes using the Mapping API or reindexing In Elasticsearch.
I am new to Elasticsearch but faced similar problem. According to my understanding once a mapping is decided for a index it cannot be changed.
Please check the following link:
https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html
"We can update a mapping to add a new field, but we can’t change an existing field from analyzed to not_analyzed."
But what you can do is update the mapping of a new field. So you can change the datatype of the data and save it again as a new field.
I have a problem about my index. Some document of this index cannot be deleted.
I can get the document with :
GET /my_index/my_type/FXN5gs9QRk-xS3ag8RxmZg?routing=12345
but I cannot delete it with:
DELETE /my_index/my_type/FXN5gs9QRk-xS3ag8RxmZg
and with this one too :
DELETE /my_index/my_type/FXN5gs9QRk-xS3ag8RxmZg?routing=12345
When I tried to delete it returns 504 Time Out.
And also I cannot add new document with the same routing.
PS:
ElasticSearch Version : 1.4
Doc Count in that type: More than 400,000,000
6 shards and 3 replicas
EDIT :
I cannot even add new document with this routing.
You need to specify the routing value in the delete too. Once you index documents with a custom routing value, you "take control" of where documents are placed. ES won't know where to find it unless you provide the routing every time:
DELETE /my_index/my_type/FXN5gs9QRk-xS3ag8RxmZg?routing=12345
Although the timeout might be a different issue, since you should simply get a "File Not Found" style exception (or worse, if you haven't made routing required, deleting an unrelated document).
I create an index "myindex" with a specified document type "mytype". I am able to delete the index, but it appears that "mytype" still exists without being tied to the index.
How do I get rid of "mytype"?
If you really deleted the index, the mapping in this index should not exist anymore.
Do you have any other index in your cluster with a similar type name?
To answer to the question: How to delete document types in elasticsearch?, use Delete Mapping API:
curl -XDELETE http://localhost:9200/index/type
EDIT: From elasticsearch 2.0, it won't be possible anymore. See Mapping changes. You will have to install the Delete By Query plugin and run a query which will remove your documents but the mapping will still exist. So it will most likely better to reindex your documents in another index without the old type.
But as #mguillemin and #javanna said, when you delete an index, every mapping attached to this index is deleted as well:
curl -XDELETE http://localhost:9200/index
You can use _delete_by_query path to delete type.
POST index-name/type-name/_delete_by_query
{
"query": {
"match": {
"message": "some message"
}
}
}
For further reading see docs
In the latest version of elastic search, they no longer support deleting document types. It's mentioned in the documentation
It is no longer possible to delete the mapping for a type. Instead you
should delete the index and recreate it with the new mappings.
You don't even need to specify the request body. Just
curl -XPOST http://<host>:9200/<index>/<type>/_delete_by_query