使用 API 后搜索不返回日志

如何解决使用 API 后搜索不返回日志

我想在使用 nesT 的 asp.net 核心 Web api 应用程序中从 elasticsearch 返回包含“level”：“error”的日志。我查看了 search_after api {{3} } 并查看了 Search After API 的另一个资源。在 Kibana CLI 上，我写了以下内容：

GET elastic-search-app-log*/_search
{
  "size": 3000,"query": {
    "match": {
      "level": "Error"
    }
  },"search_after": [3000],"sort":[
    {"@timestamp": "asc"}
  ]
}

我只是将大小设置为随机大小，并在每 3000 个索引后搜索。

因此，在 .net 方面，我尝试将其翻译为：

ESFieldsController

        private readonly IElasticclient _elasticclient;

        public ESFieldsController(IElasticclient elasticclient)
        {
            _elasticclient = elasticclient;
        }

        [HttpGet]
        public async Task<ESFields> Get()
        {
            var response = await _elasticclient.SearchAsync<ESFields>(s => s
                .Index("elastic-search-app-logs*")
                .Size(3000)
                .Query(q => q.Match(m => m.Field(f => f.Level == "error")))
                .SearchAfter(3000)
                .sort(srt => srt
                      .Ascending(p => p.TimeStamp)));

            Console.WriteLine(response);
            
            return response?.Documents?.FirstOrDefault();
        }

ESFields

namespace ESPractice.Models
{
    public class ESFields
    {
        public String Level { get; set; }
        public DateTime TimeStamp { get; set; }
    }
}

但是，当我运行应用程序并出现 swagger 时，我尝试执行 get cmd 以查看它是否有效，但它不返回包含 "level": "error" 的日志。 我在翻译时做错了什么吗？

Paginate Search After

---

附加信息：

startup.cs

        public void ConfigureServices(IServiceCollection services)
        {

            services.AddControllers();
            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1",new OpenApiInfo { Title = "ESPractice",Version = "v1" });
            });

            // create a new node instance 
            var node = new Uri("http://localhost:9200");
            // settings instance for the node
            var settings = new ConnectionSettings(node);

            services.AddSingleton<IElasticclient>(new Elasticclient(settings));
        }

以下所有内容均来自我将日志写入 elasticsearch 的单独应用程序：

    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .UseSerilog((context,configuration) =>
                {
                    configuration.Enrich.FromLogContext()
                        .Enrich.WithMachineName()
                        .Writeto.Console()
                        .Writeto.Elasticsearch(
                            new ElasticsearchSinkOptions(new Uri(context.Configuration["ElasticConfiguration:Uri"]))
                            {
                               IndexFormat = $"{context.Configuration["ApplicationName"]}-logs-{context.HostingEnvironment.EnvironmentName?.ToLower().Replace(".","-")}-{DateTime.UtcNow:yyyy-MM}",AutoRegisterTemplate = true,})
                        .Enrich.WithProperty("Environment",context.HostingEnvironment.EnvironmentName)
                        .ReadFrom.Configuration(context.Configuration);
                })
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup<Startup>();
                });
    }

appsettings.json

{
  "ApplicationName": "elastic-search-app","Serilog": {
    "MinimumLevel": {
      "Default": "information","Override": {
        "Microsoft": "information","System": "Warning"
      }
    }
  },"ElasticConfiguration": {
    "Uri": "http://localhost:9200"
  },"AllowedHosts": "*"
}