graylog 索引模版处理

graylog 默认分词只支持对应几个固定的字段，如果需要自定义索引信息，就可以使用模版能力，默认包含了一个graylog-internal，order 为-1 但是我们可以扩展

默认索引信息

• 查询信息

GET <endpoint>/_template/graylog-internal?pretty'
效果

{
    "graylog-internal": {
        "order": -1,
        "index_patterns": [
            "graylog_*"
        ],
        "settings": {
            "index": {
                "analysis": {
                    "analyzer": {
                        "analyzer_keyword": {
                            "filter": "lowercase",
                            "tokenizer": "keyword"
                        }
                    }
                }
            }
        },
        "mappings": {
            "_source": {
                "enabled": true
            },
            "dynamic_templates": [
                {
                    "internal_fields": {
                        "mapping": {
                            "type": "keyword"
                        },
                        "match_mapping_type": "string",
                        "match": "gl2_*"
                    }
                },
                {
                    "store_generic": {
                        "mapping": {
                            "type": "keyword"
                        },
                        "match_mapping_type": "string"
                    }
                }
            ],
            "properties": {
                "gl2_processing_timestamp": {
                    "format": "uuuu-MM-dd HH:mm:ss.SSS",
                    "type": "date"
                },
                "gl2_accounted_message_size": {
                    "type": "long"
                },
                "gl2_receive_timestamp": {
                    "format": "uuuu-MM-dd HH:mm:ss.SSS",
                    "type": "date"
                },
                "full_message": {
                    "fielddata": false,
                    "analyzer": "standard",
                    "type": "text"
                },
                "streams": {
                    "type": "keyword"
                },
                "source": {
                    "fielddata": true,
                    "analyzer": "analyzer_keyword",
                    "type": "text"
                },
                "message": {
                    "fielddata": false,
                    "analyzer": "standard",
                    "type": "text"
                },
                "timestamp": {
                    "format": "uuuu-MM-dd HH:mm:ss.SSS",
                    "type": "date"
                }
            }
        },
        "aliases": {}
    }
}
      

}      

调整

• 模版内容

{
  "template": "graylog_*",
  "index_patterns": ["*"],
  "mappings": {
    "properties": {
      "http_method": {
        "type": "keyword"
      },
      "http_response_code": {
        "type": "long"
      },
      "ingest_time": {
        "type": "date",
        "format": "strict_date_time"
      },
      "took_ms": {
        "type": "long"
      },
      "response_body": {
        "type": "text"
      },
      "request_body": {
        "type": "text"
      },
      "request": {
        "type": "text"
      },
      "http_user_agent": {
        "type": "text"
      }
    }
  }
}
配置
PUT /_template/graylog-custom-mapping?pretty
查看效果
GET /_template/graylog-custom-mapping?pretty
内容

{
  "graylog-custom-mapping": {
    "order": 0,
    "index_patterns": [
      "*"
    ],
    "settings": {},
    "mappings": {
      "properties": {
        "request": {
          "type": "text"
        },
        "http_method": {
          "type": "keyword"
        },
        "ingest_time": {
          "format": "strict_date_time",
          "type": "date"
        },
        "request_body": {
          "type": "text"
        },
        "took_ms": {
          "type": "long"
        },
        "response_body": {
          "type": "text"
        },
        "http_response_code": {
          "type": "long"
        },
        "http_user_agent": {
          "type": "text"
        }
      }
    },
    "aliases": {}
  }
}      

}      

代码处理

graylog2-server/src/main/java/org/graylog2/indexer/indices/Indices.java

• Indices.java

public void ensureIndexTemplate(IndexSet indexSet) {
      final IndexSetConfig indexSetConfig = indexSet.getConfig();
      final String templateName = indexSetConfig.indexTemplateName();
      try {
          final Map<String, Object> template = buildTemplate(indexSet, indexSetConfig);
          if (indicesAdapter.ensureIndexTemplate(templateName, template)) {
              LOG.info("Successfully ensured index template {}", templateName);
          } else {
              LOG.warn("Failed to create index template {}", templateName);
          }
      } catch (IgnoreIndexTemplate e) {
          LOG.warn(e.getMessage());
          if (e.isFailOnMissingTemplate() && !indicesAdapter.indexTemplateExists(templateName)) {
              throw new IndexTemplateNotFoundException(f("No index template with name '%s' (type - '%s') found in Elasticsearch",
                      templateName, indexSetConfig.indexTemplateType().orElse(null)));
          }
      }
  }
不同es 适配
比如es7 IndicesAdapterES7.java
 
@Override
  public boolean ensureIndexTemplate(String templateName, Map<String, Object> template) {
      final PutIndexTemplateRequest request = new PutIndexTemplateRequest(templateName)
              .source(template);
 
      final AcknowledgedResponse result = client.execute((c, requestOptions) -> c.indices().putTemplate(request, requestOptions),
              "Unable to create index template " + templateName);
 
      return result.isAcknowledged();
  }      

}      

具体内部处理实际上是基于了sysjob，相关job 如下

es 索引模型

• 写路径

• 读路径

说明

参考资料