如何在kibana中搜索嵌套键

编程问答 2022-06-07

问题描述

我有类似这样的kibana文档

{
  "_index": "echo.caspian-test.2020-06-11.idx.2","_type": "status","_id": "01754abe95fd084495da20646194fdf7","_score": 1,"_source": {
    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoClientVersion": "1.5.1","echoMetadata": {
      "transportType": "echo"
    },"dataCenter": "hdc-digital-non-prod","echoLoggerVersion": "EchoLogbackAppender-1.5.1","host": "e22ab1e4-9256-438b-5855-ad04","type": "INFO","message": "AddUpdate process method ends","messageDetail": {
      "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "dispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
    },"routingKey": "caspian-test","timestamp": "1603276805250"
  },"fields": {
    "timestamp": [
      "2020-10-21T10:40:05.250Z"
    ]
  }
}

我需要搜索具有特定connectionId的所有文档

“ messageDetail”：{ “ logger”：“ com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl”， “ thread”：“ dispatchThread：[com.ibm.mq.jmqi.remote.impl.RemoteSession [：/ 1f6e1b6c] [connectionId = 414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]” }

我该怎么做。我尝试搜索messageDetail.thread =％$ CONNECTION_ID％，但没有成功

解决方法

您需要在搜索查询中添加一个nested path才能使其正常工作，并且您的messageDetail必须是django each user needs to create and view data Issue，如下所示

{
    "query": {
        "nested": {
            "path": "messageDetail",--> note this
            "query": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "messageDetail. thread": "CONNECTION_ID"
                            }
                        }
                    ]
                }
            }
        }
    }
}

添加包含映射，搜索查询和结果的工作示例

索引映射 

{
    "mappings": {
        "properties": {
            "messageDetail": {
                "type" : "nested"
            }
        }
    }
}

索引样本文档 

{
    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoClientVersion": "1.5.1","echoMetadata": {
        "transportType": "echo"
    },"dataCenter": "hdc-digital-non-prod","echoLoggerVersion": "EchoLogbackAppender-1.5.1","host": "e22ab1e4-9256-438b-5855-ad04","type": "INFO","message": "AddUpdate process method ends","messageDetail": {
        "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
    },"routingKey": "caspian-test","timestamp": "1603276805250"
}

并搜索查询 

{
    "query": {
        "nested": {
            "path": "messageDetail","query": {
                "bool": {
                    "must": [
                        {
                            "match": {
                                "messageDetail.thread": "DispatchThread"
                            }
                        }
                    ]
                }
            }
        }
    }
}

并搜索资源 

"hits": [
            {
                "_index": "nestedmsg","_type": "_doc","_id": "1","_score": 0.2876821,"_source": {
                    "applicationVersion": "9f80e49dea1c647fa1baf2e70665aba3a74158eb","echoMetadata": {
                        "transportType": "echo"
                    },"messageDetail": {
                        "logger": "com.kroger.cxp.app.transformer.processor.AddUpdateTransformerImpl","thread": "DispatchThread: [com.ibm.mq.jmqi.remote.impl.RemoteSession[:/1f6e1b6c][connectionId=414D5143514D2E4150504C2E54455354967C7F5F0407B82E]]"
                    },"timestamp": "1603276805250"
                }
            }
        ]
elasticsearchkibanakibana-6