如何解决如何在kibana中搜索嵌套键
我有类似这样的kibana文档
{
"_index": "echo.caspian-test.2020-06-11.idx.2","_type": "status","_id": "01754abe95fd084495da20646194fdf7","_score": 1,"_source": {
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoClientVersion": "1.5.1","echoMetadata": {
"transportType": "echo"
},"dataCenter": "hdc-digital-non-prod","echoLoggerVersion": "EchoLogbackAppender-1.5.1","host": "e22ab1e4-9256-438b-5855-ad04","type": "INFO","message": "AddUpdate process method ends","messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "dispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},"routingKey": "caspian-test","timestamp": "1603276805250"
},"fields": {
"timestamp": [
"2020-10-21T10:40:05.250Z"
]
}
}
我需要搜索具有特定connectionId的所有文档
“ messageDetail”:{ “ logger”:“ com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl”, “ thread”:“ dispatchThread:[com.ibm.mq.jmqi.remote.impl.RemoteSession [:/ 1f6e1b6c] [connectionId = 414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]” }
我该怎么做。我尝试搜索messageDetail.thread =%$ CONNECTION_ID%,但没有成功
解决方法
您需要在搜索查询中添加一个nested path
才能使其正常工作,并且您的messageDetail
必须是django each user needs to create and view data Issue,如下所示
{
"query": {
"nested": {
"path": "messageDetail",--> note this
"query": {
"bool": {
"must": [
{
"match": {
"messageDetail. thread": "CONNECTION_ID"
}
}
]
}
}
}
}
}
添加包含映射,搜索查询和结果的工作示例
索引映射
{
"mappings": {
"properties": {
"messageDetail": {
"type" : "nested"
}
}
}
}
索引样本文档
{
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoClientVersion": "1.5.1","echoMetadata": {
"transportType": "echo"
},"dataCenter": "hdc-digital-non-prod","echoLoggerVersion": "EchoLogbackAppender-1.5.1","host": "e22ab1e4-9256-438b-5855-ad04","type": "INFO","message": "AddUpdate process method ends","messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},"routingKey": "caspian-test","timestamp": "1603276805250"
}
并搜索查询
{
"query": {
"nested": {
"path": "messageDetail","query": {
"bool": {
"must": [
{
"match": {
"messageDetail.thread": "DispatchThread"
}
}
]
}
}
}
}
}
并搜索资源
"hits": [
{
"_index": "nestedmsg","_type": "_doc","_id": "1","_score": 0.2876821,"_source": {
"applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoMetadata": {
"transportType": "echo"
},"messageDetail": {
"logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
},"timestamp": "1603276805250"
}
}
]
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。