如何在kibana中搜索嵌套键

7vhp5slm 于 2021-06-14 发布在 ElasticSearch

关注(0)|答案(1)|浏览(505)

我有这样的kibana文件

{
  "_index": "echo.caspian-test.2020-06-11.idx.2",
  "_type": "status",
  "_id": "01754abe95fd084495da20646194fdf7",
  "_score": 1,
  "_source": {
    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
    "echoClientVersion": "1.5.1",
    "echoMetadata": {
      "transportType": "echo"
    },
    "dataCenter": "hdc-digital-non-prod",
    "echoLoggerVersion": "EchoLogbackAppender-1.5.1",
    "host": "e22ab1e4-9256-438b-5855-ad04",
    "type": "INFO",
    "message": "AddUpdate process method ends",
    "messageDetail": {
      "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
      "thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
    },
    "routingKey": "caspian-test",
    "timestamp": "1603276805250"
  },
  "fields": {
    "timestamp": [
      "2020-10-21T10:40:05.250Z"
    ]
  }
}

我需要搜索所有文档有一个特定的connectionid，这是在
“messagedetail”：{“logger”：“com.kroger.cxp.app.transformer.processor.addupdatetransformerimpl”，“thread”：“调度线程：[com.ibm.mq.jmqi.remote.impl.remotesession[：/1f6e1b6c][connectionid=414D5143514D2E4150504C2E5445534967C7F5F0407B82E]]”
我怎么能那样做。我已尝试搜索messagedetail.thread=%$connection\u id%，但无效

elasticsearch kibana kibana-6

来源：https://stackoverflow.com/questions/64462703/how-to-search-for-a-nested-key-in-kibana

1条答案

按热度按时间

w8f9ii691#

你需要添加一个 nested path 在您的搜索查询，使其工作和您的 messageDetail 必须是嵌套数据类型，如下所示

{
    "query": {
        "nested": {
            "path": "messageDetail", --> note this
            "query": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "messageDetail. thread": "CONNECTION_ID"
                            }
                        }
                    ]
                }
            }
        }
    }
}

添加带有Map、搜索查询和结果的工作示例
索引Map

{
    "mappings": {
        "properties": {
            "messageDetail": {
                "type" : "nested"
            }
        }
    }
}

索引示例文档

{
    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
    "echoClientVersion": "1.5.1",
    "echoMetadata": {
        "transportType": "echo"
    },
    "dataCenter": "hdc-digital-non-prod",
    "echoLoggerVersion": "EchoLogbackAppender-1.5.1",
    "host": "e22ab1e4-9256-438b-5855-ad04",
    "type": "INFO",
    "message": "AddUpdate process method ends",
    "messageDetail": {
        "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
        "thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
    },
    "routingKey": "caspian-test",
    "timestamp": "1603276805250"
}

和搜索查询

{
    "query": {
        "nested": {
            "path": "messageDetail",
            "query": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "messageDetail.thread": "DispatchThread"
                            }
                        }
                    ]
                }
            }
        }
    }
}

和搜索资源

"hits": [
            {
                "_index": "nestedmsg",
                "_type": "_doc",
                "_id": "1",
                "_score": 0.2876821,
                "_source": {
                    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb",
                    "echoClientVersion": "1.5.1",
                    "echoMetadata": {
                        "transportType": "echo"
                    },
                    "dataCenter": "hdc-digital-non-prod",
                    "echoLoggerVersion": "EchoLogbackAppender-1.5.1",
                    "host": "e22ab1e4-9256-438b-5855-ad04",
                    "type": "INFO",
                    "message": "AddUpdate process method ends",
                    "messageDetail": {
                        "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl",
                        "thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
                    },
                    "routingKey": "caspian-test",
                    "timestamp": "1603276805250"
                }
            }
        ]

赞(0）回复(0）举报 2021-06-14

我来回答

如何在kibana中搜索嵌套键

1条答案

相关问题

热门标签

最新问答