elasticsearch - 在elasticsearch中获取数据流时间戳元字段已被禁用错误

Question

我正在尝试将数据流载入我的 es 集群。我已经创建了具有必要阶段的 ilm，创建了索引模板，然后创建了数据流。但我被困在某一点上，无法前进。

我创建了如下的索引模板。

{
  "index_patterns": [
    "*",
    "-.*"
  ],
  "priority": 500,
  "data_stream": {},
  "template": {
    "settings": {
      "index": {
        "unassigned.node_left.delayed_timeout": "20m",
        "search.idle.after": "20s",
        "lifecycle": {
          "name": "my-datastream-ilm"
        },
        "indexing": {
          "slowlog": {
            "threshold": {
              "index": {
                "warn": "5s",
                "info": "2s",
                "debug": "800ms",
                "trace": "300ms"
              }
            }
          }
        },
        "search": {
          "slowlog": {
            "threshold": {
              "query": {
                "warn": "10s",
                "info": "5s",
                "debug": "2s",
                "trace": "500ms"
              },
              "fetch": {
                "warn": "10s",
                "info": "5s",
                "debug": "2s",
                "trace": "500ms"
              }
            }
          }
        },
        "refresh_interval": "30s",
        "codec": "best_compression",
        "analysis": {
          "analyzer": {
            "case_insensitive_keyword_analyzer": {
              "tokenizer": "keyword",
              "filter": "lowercase"
            }
          }
        }
      }
    },
    "mappings": {
      "properties": {
        "@timestamp": {
            "type": "date",
            "format": "date_optional_time||epoch_millis"
        },
        "client": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          }
        },
        "action": {
          "type": "text",
          "analyzer": "case_insensitive_keyword_analyzer",
          "index_options": "docs",
          "norms": false,
          "fields": {
            "raw": {
              "type": "keyword"
            }
          }
        },
      "dynamic_templates": [
        {
          "default_string_mapping": {
            "match": "*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "text",
              "analyzer": "case_insensitive_keyword_analyzer",
              "norms": false,
              "index_options": "docs",
              "fields": {
                "raw": {
                  "type": "keyword"
                }
              },
              "index": false
            }
          }
        },
        {
          "geopoint_mapping": {
            "match": "geopoint_*",
            "mapping": {
              "type": "geo_point",
              "index": false
            }
          }
        },
        {
          "string_mapping": {
            "match": "string_*",
            "mapping": {
              "type": "text",
              "analyzer": "case_insensitive_keyword_analyzer",
              "norms": false,
              "index_options": "docs",
              "fields": {
                "raw": {
                  "type": "keyword"
                }
              },
              "index": false
            }
          }
        },
        {
          "bool_mapping": {
            "match": "bool_*",
            "mapping": {
              "type": "boolean",
              "index": false
            }
          }
        },
        {
          "datetime_mapping": {
            "match": "datetime_*",
            "mapping": {
              "type": "date",
              "index": false
            }
          }
        },
        {
          "long_mapping": {
            "match": "long_*",
            "mapping": {
              "type": "long",
              "index": false
            }
          }
        },
        {
          "double_mapping": {
            "match": "double_*",
            "mapping": {
              "type": "double",
              "index": false
            }
          }
        },
        {
          "object_mapping": {
            "match": "object_*",
            "mapping": {
              "type": "nested",
              "index": false
            }
          }
        }
      ]
    }
  }
}

之后，当我尝试创建数据流索引时，出现以下错误。

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_state_exception",
        "reason" : "[_data_stream_timestamp] meta field has been disabled"
      }
    ],
    "type" : "illegal_state_exception",
    "reason" : "[_data_stream_timestamp] meta field has been disabled"
  },
  "status" : 500
}

我在哪里错了？

标签： elasticsearch