MySQL慢查询日志ES索引模板

Posted 2020-09-24 运维小兵

{
    "template": "mysql-slow-log-*",
    "settings": {
        "index": {
            "refresh_interval": "5s"
        }
    },
    "mappings": {
        "mysql-slow-log": {
            "numeric_detection": true, //开启数值类型设置
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "format": "strict_date_optional_time||epoch_millis"
                },
                "@version": {
                    "type": "string"
                },
                "Query_time": {
                    "type": "double"    //设置该字段为double类型的
                },
                "Row_sent": {
                    "type": "string"
                },
                "Rows_examined": {
                    "type": "string"
                },
                "clientip": {
                    "type": "string"
                },
                "envCode": {
                    "type": "string"
                },
                "host": {
                    "type": "string"
                },
                "id": {
                    "type": "string"
                },
                "lock_time": {
                    "type": "string"
                },
                "message": {
                    "type": "string"
                },
                "mysqlType": {
                    "type": "string",
                    "norms": {
                        "enabled": false
                    },
                    "fielddata": {
                        "format": "disabled"
                    },
                    "fields": {     //产生.raw聚合
                        "raw": {
                            "type": "string",
                            "index": "not_analyzed",
                            "ignore_above": 256
                        }
                    }
                },
                "nsCode": {
                    "type": "string"
                },
                "path": {
                    "type": "string"
                },
                "sql": {
                    "type": "string",
                    "index": "not_analyzed"     //在创建索引的时候，该字段不分词
                },
                "tags": {
                    "type": "string"
                },
                "timestamp": {
                    "type": "string"
                },
                "type": {
                    "type": "string"
                },
                "user": {
                    "type": "string"
                }
            }
        }
    }
}