elasticsearch - Elasticsearch 时间范围查询和数据
问题描述
我正在努力为 Elastic Search 制定正确的 API 搜索调用,该调用将在过去 1 小时内要求我想要的 ipv4address。
第一次尝试:
curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
{
"query": {
"match": {
"ipv4address": {
"query": "50.167.71.25"
}
}
},
"range": {
"@timestamp": {
"gte": "now-1h",
"lt": "now"
}
}
}
'
{"error":{"root_cause":[{"type":"parsing_exception","reason":"[range] 中 START_OBJECT 的未知键。","line":10,"col":12}] ,"type":"parsing_exception","reason":"[range] 中 START_OBJECT 的未知键。","line":10,"col":12},"status":400}
第二次尝试:
curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
{
"query": {
"match": {
"ipv4address": {
"query": "50.167.71.25"
}
}
},
"fields": {
"range": {
"@timestamp": {
"gte": "now-1h",
"lt": "now"
}
}
}
}
'
{"error":{"root_cause":[{"type":"parsing_exception","reason":"[fields] 中 START_OBJECT 的未知键。","line":10,"col":14}] ,"type":"parsing_exception","reason":"[fields] 中 START_OBJECT 的未知键。","line":10,"col":14},"status":400}
我在 Kibana 拥有的东西:
{
"_index": "ipaddresses",
"_type": "default",
"_id": "TJdvR2UB9sEBYW4CrElF",
"_version": 1,
"_score": null,
"_source": {
"tags": [
"blocked",
"ipv4_address",
],
"@version": "1",
"@timestamp": "2018-08-17T10:30:25.118Z",
"ipv4_metadata": {
"host": "elk",
"name": "blocks",
"response_message": "OK",
"code": 200,
"times_retried": 0,
"runtime_seconds": 0.066403,
"response_headers": {
"connection": "keep-alive",
"x-frame-options": "sameorigin",
"last-modified": "Fri, 17 Aug 2018 10:28:06 GMT",
"keep-alive": "timeout=20",
"date": "Fri, 17 Aug 2018 10:28:20 GMT",
"content-type": "text/plain; charset=UTF-8",
"server": "nginx/1.12.2",
"transfer-encoding": "chunked",
"etag": "W/\"5c7c5-5739f03f2997f\"",
"cache-control": "public"
}
},
"ipv4address": "50.167.71.25",
"message": "50.167.71.25"
},
"fields": {
"@timestamp": [
"2018-08-17T10:30:25.118Z"
]
},
"sort": [
1534501825118
]
}
查询有什么问题?如果我也想查找等于阻塞的“标签”字段怎么办?
请帮我连接点。
解决方案
此查询将返回过去 1 小时的文档:
{
"query": {
"range": {
"@timestamp": {
"gte": "now-1h",
"lt": "now"
}
}
}
}
此查询将返回标记被阻止且来自最近 1 小时的文档:
{
"query": {
"bool": {
"must": [
{
"match": {
"tags": "blocked"
}
},
{
"range": {
"@timestamp": {
"gte": "now-1h",
"lte": "now"
}
}
}
]
}
}
}
您可以使用_source限制要返回的数据。
此查询将仅返回ipv4address:
{
"_source": "ipv4address",
"query": {
"bool": {
"must": [
{
"match": {
"tags": "blocked"
}
},
{
"range": {
"@timestamp": {
"gte": "now-1h",
"lte": "now"
}
}
}
]
}
}
}
如果您想应用更多查询,请查看此。
推荐阅读
- c - 尝试在 ELF 二进制文件中执行注入代码时收到分段错误
- node.js - Nest.js 部署使用多个 lambda 函数
- android - ViewPAger2 中带有 GridLayoutManager 的 RecyclerView 在前 3 页中没有显示任何内容
- css - 反应 CSS 表单验证
- python - 不调用 mosquitto -d 就不会启动 Mosquitto
- amazon-web-services - Java SDK v2.x 中 KCL 的 dynamodb 流适配器
- php - 使用 PHP 清理 HTML 源代码
- arrays - BigQuery:从 json 对象中提取键,将 json 从对象转换为键值数组
- javascript - 为什么我不能从这个回调函数内部调用一个类方法?错误类型错误:这是未定义的
- python - 使用烧瓶将数据插入 postgresql 时,如何解决 UniqueConstraint 错误?