elasticsearch - 如何为特定的kibana可视化数据查询elasticsearch？

Question

在我们集群的 kibana 仪表板中，我看到了一个可视化，它为我提供了应用程序的传入流量总数。我想要的是使用 curl 调用获得相同的传入流量计数，以便我可以自动化一些报告。为此，首先我检查可视化并单击请求，以下是我得到的

{
  "aggs": {},
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "time",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "filter": [
              {
                "bool": {
                  "must_not": {
                    "bool": {
                      "should": [
                        {
                          "query_string": {
                            "fields": [
                              "remote_addr"
                            ],
                            "query": "\\1\\0\\.\\0\\.*"
                          }
                        }
                      ],
                      "minimum_should_match": 1
                    }
                  }
                }
              },
              {
                "bool": {
                  "filter": [
                    {
                      "bool": {
                        "must_not": {
                          "bool": {
                            "should": [
                              {
                                "query_string": {
                                  "fields": [
                                    "remote_addr"
                                  ],
                                  "query": "\\1\\0\\0\\.\\0\\.*"
                                }
                              }
                            ],
                            "minimum_should_match": 1
                          }
                        }
                      }
                    },
                    {
                      "bool": {
                        "filter": [
                          {
                            "bool": {
                              "must_not": {
                                "bool": {
                                  "should": [
                                    {
                                      "match_phrase": {
                                        "upstream_addr.keyword": “IP_ADDR:PORT”
                                      }
                                    }
                                  ],
                                  "minimum_should_match": 1
                                }
                              }
                            }
                          },
                          {
                            "bool": {
                              "filter": [
                                {
                                  "bool": {
                                    "must_not": {
                                      "bool": {
                                        "should": [
                                          {
                                            "match_phrase": {
                                              "upstream_addr.keyword": “IP_ADDR:PORT”
                                            }
                                          }
                                        ],
                                        "minimum_should_match": 1
                                      }
                                    }
                                  }
                                },
                                {
                                  "bool": {
                                    "filter": [
                                      {
                                        "bool": {
                                          "must_not": {
                                            "bool": {
                                              "should": [
                                                {
                                                  "match_phrase": {
                                                    "upstream_addr.keyword": “IP_ADDR:PORT”
                                                  }
                                                }
                                              ],
                                              "minimum_should_match": 1
                                            }
                                          }
                                        }
                                      },
                                      {
                                        "bool": {
                                          "must_not": {
                                            "bool": {
                                              "should": [
                                                {
                                                  "match_phrase": {
                                                    "upstream_addr.keyword": “IP_ADDR:PORT”
                                                  }
                                                }
                                              ],
                                              "minimum_should_match": 1
                                            }
                                          }
                                        }
                                      }
                                    ]
                                  }
                                }
                              ]
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            ]
          }
        },
        {
          "match_all": {}
        },
        {
          "match_phrase": {
            "kubernetes.labels.app.keyword": {
              "query": "kong"
            }
          }
        },
        {
          "exists": {
            "field": "status"
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2021-01-05T09:32:46.946Z",
              "lte": "2021-01-05T09:47:46.946Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "http_user_agent": "CloudWatchSynthetics"
                }
              },
              {
                "match_phrase": {
                  "http_user_agent": "Amazon-Route53-Health-Check-Service"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  }
}

现在，我接受了这个请求正文，并像下面这样对 elasticsearch 进行了 curl 调用

curl -u elastic:password -x GET "localhost:9200/_mget?pretty" -H 'Content-Type: application/json' -d'
<request_body_that_I_have_pasted_above>
'

但是，这会引发以下错误

{
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "unexpected token [START_OBJECT], expected [FIELD_NAME] or [START_ARRAY]",
        "line" : 3,
        "col" : 11
      }
    ],
    "type" : "parsing_exception",
    "reason" : "unexpected token [START_OBJECT], expected [FIELD_NAME] or [START_ARRAY]",
    "line" : 3,
    "col" : 11
  },
  "status" : 400
}

我的做法对吗？我在这里做错了什么？

标签： elasticsearchcurlkibanaelastic-stackelk