Python调用Elasticsearch parallel_bulk无报错但索引无数据如何排查

问题2：bulk函数执行报index is missing错误 #

故障原因 #

你混淆了ES原生REST Bulk API的入参格式和Python客户端elasticsearch.helpers.bulk的入参要求：

• 原生REST API要求传入换行分隔的NDJSON字符串，但Python的helpers.bulk函数要求第二个入参为可迭代的动作字典，你传入字符串的话，函数会将字符串按单个字符拆分解析为动作，自然每个拆分后的片段都不存在index字段，触发报错。
• 你调用bulk(es,test_docs, "sailpont-dev-logs")时第三个参数用位置传递，而helpers.bulk的第三个位置参数是stats_only，并不会被识别为默认索引名，即使要指定默认索引也要用关键字参数index="sailpont-dev-logs"。

修复方案 #

将测试数据调整为符合helpers要求的字典列表格式：

test_docs = [
    {
        "_op_type": "create",
        "_index": "sailpont-dev-logs",
        "_source": {
            "Created":  "2021-04-30T18:35:16.587Z", 
            "Action":  "AccessRequestCancelled",
            "Type":  "ACCESS_REQUESTT",
            "Actor":  "matepric",
            "Target":  "brianschaffner",
            "Stack":  "wps",
            "TrackingNumber":  "2c9180867a5ca31f017a5e332e763f9", 
            "Objects":  "ACCESS", 
            "Operation":  "REQUEST", 
            "Status":  "CANCELLED",
            "TechnicalName":  "ACCESS_REQUEST_CANCELLEDs",
            "Name":  "Request Access Cancelled!"
        }
    },
    {
        "_op_type": "create",
        "_index": "sailpont-dev-logs",
        "_source": {
            "Created":  "2021-04-29T18:35:16.587Z", 
            "Action":  "AccessRequestCancelled",
            "Type":  "ACCESS_REQUESTT",
            "Actor":  "matepric",
            "Target":  "brianschaffner",
            "Stack":  "wps",
            "TrackingNumber":  "2c9180867a5ca31f017a5e332e763f9", 
            "Objects":  "ACCESS", 
            "Operation":  "REQUEST", 
            "Status":  "CANCELLED",
            "TechnicalName":  "ACCESS_REQUEST_CANCELLEDs",
            "Name":  "Request Access Cancelled!"
        }
    }
]
# 不需要额外传索引参数，每个动作内已指定
bulk(es, test_docs)

内容的提问来源于stack exchange，提问作者opti2k4