你可以做到,但你需要自己构建整个结构。索引模式定义如下所示:
PUT .kibana/doc/index-pattern:<some-uuid>
{
"type": "index-pattern",
"updated_at": "2018-01-27T07:12:05.373Z",
"index-pattern": {
"title": "test*",
"timeFieldName": "@timestamp",
"fields": """ ... """,
}
}
-
title
是索引模式的名称,与通过 UI 创建索引模式时输入的名称相同
-
timeFieldName
是时间戳字段的名称
-
fields
是一个字符串,其中包含索引模式中所有字段定义的 JSON 数组(见下文)
字段定义如下所示:
[
{
"name": "@timestamp",
"type": "date",
"count": 0,
"scripted": false,
"searchable": true,
"aggregatable": true,
"readFromDocValues": true
},
{
"name": "_id",
"type": "string",
"count": 0,
"scripted": false,
"searchable": true,
"aggregatable": true,
"readFromDocValues": false
},
{
"name": "_index",
"type": "string",
"count": 0,
"scripted": false,
"searchable": true,
"aggregatable": true,
"readFromDocValues": false
},
{
"name": "_score",
"type": "number",
"count": 0,
"scripted": false,
"searchable": false,
"aggregatable": false,
"readFromDocValues": false
},
{
"name": "_source",
"type": "_source",
"count": 0,
"scripted": false,
"searchable": false,
"aggregatable": false,
"readFromDocValues": false
},
{
"name": "_type",
"type": "string",
"count": 0,
"scripted": false,
"searchable": true,
"aggregatable": true,
"readFromDocValues": false
},
{
"name": "referer",
"type": "string",
"count": 0,
"scripted": false,
"searchable": true,
"aggregatable": false,
"readFromDocValues": false
},
...
]
因此,您需要为每个字段创建这个数组,然后将其字符串化并将字符串放入fields
field.
这是表示索引模式的示例文档:
{
"type": "index-pattern",
"updated_at": "2018-01-27T07:12:05.373Z",
"index-pattern": {
"title": "test*",
"timeFieldName": "@timestamp",
"fields": """[{"name":"@timestamp","type":"date","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"_id","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_index","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"_score","type":"number","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_source","type":"_source","count":0,"scripted":false,"searchable":false,"aggregatable":false,"readFromDocValues":false},{"name":"_type","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":false},{"name":"referer","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"referer.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"status","type":"number","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true},{"name":"url","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":false,"readFromDocValues":false},{"name":"url.keyword","type":"string","count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true}]"""
}
}