弹性搜索脚本字段

Question

我正在尝试运行脚本字段查询。我已将以下脚本放在 config/scripts 文件夹中

1 + my_var

rwxr-xr-x 3 elasticsearch elasticsearch 4096 Jan  4 16:08 ..
-rwxrwxrwx 1 root          root           145 Jan  7 11:57 session-duration-script.groovy
-rwx------ 1 root          root           124 Jan  7 12:52 calc-session-duration-script.groovy
-rwxrwxrwx 1 root          root            11 Jan  7 13:09 my_script.groovy
drwxr-xr-x 2 elasticsearch elasticsearch 4096 Jan  7 13:09 .

mgmt/cm/access/access-event-logs/session-summary/_search

{
    "script_fields": {
        "my_field": {
            "file": "my_script",
            "params": {
              "my_var": 2
            }
        }
    }

}

这是错误信息

Caused by: SearchParseException[failed to parse search source [{
   "script_fields": {
        "my_field": {
            "file": "my_script",
            "params": {
              "my_var": 2
            }
        }

   }
}]]; nested: SearchParseException[must specify a script in script fields];
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:848)
        at org.elasticsearch.search.SearchService.createContext(SearchService.java:651)
        at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:617)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:368)
        at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)
        at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)
        at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:350)
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)
Caused by: SearchParseException[must specify a script in script fields]
        at org.elasticsearch.search.fetch.script.ScriptFieldsParseElement.parse(ScriptFieldsParseElement.java:98)
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:831)
        ... 10 more

1. 我是否需要启用 groovy 脚本来运行 script_field 查询。从文档中我了解到 ES 导致执行放置在 /config/scripts 下的脚本而没有启用脚本

Answer 1

您只需将脚本字段的定义包装在 script 部分中，如下所示：

  "script_fields": {
    "my_field": {
      "script": {                 <---- add this
        "file": "my_script",
        "params": {
          "my_var": 2
        }
      }
    }
  }

还要确保从您的elasticsearch.yml 配置文件中存储的脚本文件中输入enable dynamic scripting（+重新启动您的节点）：

script.file: on