elasticsearch - 如何在kibana中搜索嵌套键
问题描述
我有看起来像这样的 kibana 文档
{
"_index": "echo.caspian-test.2020-06-11.idx.2",
"_type": "status",
"_id": "01754abe95fd084495da20646194fdf7",
"_score": 1,
"_source": {
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
"echoClientVersion": "1.5.1",
"echoMetadata": {
"transportType": "echo"
},
"dataCenter": "hdc-digital-non-prod",
"echoLoggerVersion": "EchoLogbackAppender-1.5.1",
"host": "e22ab1e4-9256-438b-5855-ad04",
"type": "INFO",
"message": "AddUpdate process method ends",
"messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
"thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},
"routingKey": "caspian-test",
"timestamp": "1603276805250"
},
"fields": {
"timestamp": [
"2020-10-21T10:40:05.250Z"
]
}
}
我需要搜索所有具有特定 connectionId 的文档
"messageDetail": { "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl", "thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c ][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]" }
我怎样才能做到这一点 。我曾尝试搜索 messageDetail.thread=%$CONNECTION_ID% 但它没有用
解决方案
您需要nested path
在搜索查询中添加一个以使其工作,并且您messageDetail
必须是嵌套数据类型,如下所示
{
"query": {
"nested": {
"path": "messageDetail", --> note this
"query": {
"bool": {
"must": [
{
"match": {
"messageDetail. thread": "CONNECTION_ID"
}
}
]
}
}
}
}
}
添加具有映射、搜索查询和结果的工作示例
索引映射
{
"mappings": {
"properties": {
"messageDetail": {
"type" : "nested"
}
}
}
}
索引示例文档
{
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
"echoClientVersion": "1.5.1",
"echoMetadata": {
"transportType": "echo"
},
"dataCenter": "hdc-digital-non-prod",
"echoLoggerVersion": "EchoLogbackAppender-1.5.1",
"host": "e22ab1e4-9256-438b-5855-ad04",
"type": "INFO",
"message": "AddUpdate process method ends",
"messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
"thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},
"routingKey": "caspian-test",
"timestamp": "1603276805250"
}
和搜索查询
{
"query": {
"nested": {
"path": "messageDetail",
"query": {
"bool": {
"must": [
{
"match": {
"messageDetail.thread": "DispatchThread"
}
}
]
}
}
}
}
}
并搜索资源
"hits": [
{
"_index": "nestedmsg",
"_type": "_doc",
"_id": "1",
"_score": 0.2876821,
"_source": {
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
"echoClientVersion": "1.5.1",
"echoMetadata": {
"transportType": "echo"
},
"dataCenter": "hdc-digital-non-prod",
"echoLoggerVersion": "EchoLogbackAppender-1.5.1",
"host": "e22ab1e4-9256-438b-5855-ad04",
"type": "INFO",
"message": "AddUpdate process method ends",
"messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
"thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},
"routingKey": "caspian-test",
"timestamp": "1603276805250"
}
}
]
推荐阅读
- mysql - 使用 WHERE 和 IN 子句的 MongoDB 查询
- scala - Apache Spark,如何获取时间间隔
- java - 当我调用服务层方法时出现 NullPointerException
- c# - 如何创建将返回公共接口的派生类型的工厂类
- c++ - 什么可用于在 c ++ 中保存图形等结构(Python pickle 等价物)
- excel - 通过 VBA 控制形状渐变属性
- c# - WPF 网格列 def auto 总是从右边剪裁
- javascript - 抓取全球速卖通:数据属性在检查元素之前不会加载
- for-loop - 如何在 ASP/VBScript 中仅提取“For Each”循环的一部分
- postgresql - postgres 不使用 postgres.conf 文件?