如何在elasticsearch中搜索数据？答案

【问题标题】：How to search for a data in elasticsearch?如何在elasticsearch中搜索数据？
【发布时间】：2018-03-20 01:25:25
【问题描述】：

最近我按照 elasticsearch 网站提供的教程将数据推送到弹性云，我已经成功地做到了。

https://www.youtube.com/watch?v=oMmLNbJPF-M

我还可以发布一个示例文档并在其中搜索一个术语。但是对于 apache 日志我不能这样做。

以下是我发布到弹性云的查询

curl -H 'Content-Type: application/json' -k -u elastic:changeme -XPUT https://5a482b9559fc4a59b6b*************.ap-southeast-1.aws.found.io:9243/test-data/cities/21 -d '{ "rank": 21, "city": "Bangalore", "state": "Karnataka"}'

当我搜索一个名为 Bangalore 的词时，我使用以下查询

curl -H 'Content-Type: application/json' -k -u elastic:changeme -XGET https://5a482b9559fc4a5****************.ap-southeast-1.aws.found.io:9243/test-data/cities/_search?pretty=true -d '{"query": {"query_string": {"query": "bangalore"}}}'

我成功得到以下结果

{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 0.2876821,
    "hits" : [
      {
        "_index" : "test-data",
        "_type" : "cities",
        "_id" : "21",
        "_score" : 0.2876821,
        "_source" : {
          "rank" : 21,
          "city" : "Bangalore",
          "state" : "Karnataka"
        }
      }
    ]
  }
}

现在对于我发布到弹性云的示例 apache 日志，如果我对索引 .monitoring-kibana-6-2018.03.16 运行查询并输入 doc，它将返回特定日志的所有信息

查询

curl -H 'Content-Type: application/json' -k -u elastic:changeme -XGET https://5a482b9559fc4a5************.ap-southeast-1.aws.found.io:9243/.monitoring-kibana-6-2018.03.19/doc/_search?pretty=true

发回的信息

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 4935,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : ".monitoring-kibana-6-2018.03.19",
        "_type" : "doc",
        "_id" : "zQyPO2IBFM2Pr3qzOtYp",
        "_score" : 1.0,
        "_source" : {
          "cluster_uuid" : "-fcvGIrYRpaQInvIaV2yxA",
          "timestamp" : "2018-03-19T00:01:05.061Z",
          "interval_ms" : 10000,
          "type" : "kibana_stats",
          "source_node" : {
            "uuid" : "QdV84OHQQHK2cqfcosLYOg",
            "host" : "172.29.73.212",
            "transport_address" : "172.29.73.212:19974",
            "ip" : "172.29.73.212",
            "name" : "instance-0000000002",
            "timestamp" : "2018-03-19T00:01:05.062Z"
          },
          "kibana_stats" : {
            "cloud" : {
              "name" : "aws",
              "id" : "ec2dd6c8-6f45-fabe-5bf4-8184ef1b3d63"
            },
            "concurrent_connections" : 66357,
            "os" : {
              "load" : {
                "1m" : 0.29833984375,
                "5m" : 0.470703125,
                "15m" : 0.5126953125
              },
              "memory" : {
                "total_in_bytes" : 32168431616,
                "free_in_bytes" : 1181507584,
                "used_in_bytes" : 30986924032
              },
              "uptime_in_millis" : 5260700000
            },
            "process" : {
              "event_loop_delay" : 90620.95409584045,
              "memory" : {
                "heap" : {
                  "total_in_bytes" : 153329664,
                  "used_in_bytes" : 137886824,
                  "size_limit" : 872415232
                },
                "resident_set_size_in_bytes" : 209448960
              },
              "uptime_in_millis" : 306763138
            },
            "requests" : {
              "disconnects" : 0,
              "total" : 63356,
              "status_codes" : {
                "200" : 1437,
                "302" : 61069,
                "304" : 839,
                "404" : 11
              }
            },
            "response_times" : {
              "average" : 2447.6666666666665,
              "max" : 3864
            },
            "timestamp" : "2018-03-19T00:01:00.092Z",
            "kibana" : {
              "uuid" : "0f753e6b-a648-433a-8b35-36de5ce4a3a5",
              "name" : "ba105a5a75ee",
              "index" : ".kibana",
              "host" : "ba105a5a75ee",
              "transport_address" : "0.0.0.0:18472",
              "version" : "6.2.2",
              "snapshot" : false,
              "status" : "green"
            },
            . . . . . . . . . . . . . . . . . . .
            . . . . . . . . . . . . . . . . . . .

它返回一个非常bg的输出，所以我只显示它的一部分。现在如果我尝试运行查询来搜索一个术语，比如response_times

查询

curl -H 'Content-Type: application/json' -k -u elastic:QbKxXTTXwxnV4kQ0UA48Kedz -XGET https://5a482b9559fc4a5****************.ap-southeast-1.aws.found.io:9243/.monitoring-kibana-6-2018.03.19/doc/_search?pretty=true -d '{"query": {"query_string": {"query": "response_times"}}}'

我得到以下输出

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

那么为什么相同的搜索查询不适用于 apache 日志？

【问题讨论】：

我认为response_times 是一个字段，而不是一个术语
@OvidiuDolha ok。但是如果有人想为一个字段搜索一个值，他们怎么做呢？
也许像 _exists_:kibana_stats.response_times 使用查询字符串？

标签： elasticsearch elastic-cloud

【解决方案1】：

取决于你想做什么，但你可以运行 Range Query 例如在 response_times 字段上：

curl -XGET 'localhost:9200/_search?pretty' -H 'Content-Type: application/json' -d'
{
    "query": {
        "range" : {
            "kibana_stats.response_times" : {
                "gte" : 3800,
                "lte" : 3900
            }
        }
    }
}
'

【讨论】：