kibana 6.2 加载样本数据
kibana loading sample data
下载样本数据
# 莎士比亚经典作品
wget https://download.elastic.co/demos/kibana/gettingstarted/shakespeare_6.0.json
# 一组虚拟生成的账户数据
wget https://download.elastic.co/demos/kibana/gettingstarted/accounts.zip
# 一组虚拟生成的日志数据
wget https://download.elastic.co/demos/kibana/gettingstarted/logs.jsonl.gz
解压文件
unzip accounts.zip
gunzip logs.jsonl.gz
数据格式
Shakespeare数据集
{
"line_id": INT,
"play_name": "String",
"speech_number": INT,
"line_number": "String",
"speaker": "String",
"text_entry": "String",
}
account数据集
{
"account_number": INT,
"balance": INT,
"firstname": "String",
"lastname": "String",
"age": INT,
"gender": "M or F",
"address": "String",
"employer": "String",
"email": "String",
"city": "String",
"state": "String"
}
logs数据集
{
"memory": INT,
"geo.coordinates": "geo_point"
"@timestamp": "date"
}
Mapping Fields
加载这些数据之前,需要先创建它们的索引,并创建字段映射
在Kibana的Dev Tools > Console中,创建索引
PUT /shakespeare
{
"mappings": {
"doc": {
"properties": {
"speaker": {"type": "keyword"},
"play_name": {"type": "keyword"},
"line_id": {"type": "integer"},
"speech_number": {"type": "integer"}
}
}
}
}
-
speaker
和play_name
被指定为keyword类型的字段,它们不会被分析器分析 -
line_id
和speech_number
被指定为integer类型
logs数据集需要映射经纬度
PUT /logstash-2015.05.18
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
PUT /logstash-2015.05.19
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
PUT /logstash-2015.05.20
{
"mappings": {
"log": {
"properties": {
"geo": {
"properties": {
"coordinates": {
"type": "geo_point"
}
}
}
}
}
}
}
accounts数据集使用默认的映射即可
加载数据集
curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/bank/account/_bulk?pretty' --data-binary @accounts.json
curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/shakespeare/doc/_bulk?pretty' --data-binary @shakespeare_6.0.json
curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/_bulk?pretty' --data-binary @logs.jsonl
查看是否成功加载
GET /_cat/indices?v