没有Java API的Java Elasticsearch查询

Question

I try to query an existing elasticsearch base in java without using the Java API. This elasticsearch base belongs to an ELK cluster.

The correct cURL query is :

curl -XGET 'http://10.60.74.134:9200/logstash-2015.04.09/_search?pretty' -d '{
  "facets": {
    "0": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "5m"
      },
      "global": true,
      "facet_filter": {
        "fquery": {
          "query": {
            "filtered": {
              "query": {
                "query_string": {
                  "query": "*"
                }
              },
              "filter": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "@timestamp": {
                          "from": 1428558001338,
                          "to": 1428579601338
                        }
                      }
                    },
                    {
                      "terms": {
                        "_type": [
                          "akaoatg-monitoring"
                        ]
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}'

which works perfectly fine and returns me my JSON results :

{
  "took" : 185,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 9106263,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "facets" : {
    "0" : {
      "_type" : "date_histogram",
      "entries" : [ {
        "time" : 1428458700000,
        "count" : 2429
      }, {
        "time" : 1428459000000,
        "count" : 21128
      }, {
        "time" : 1428459300000,
        "count" : 21354
      } ]
    }
  }
}

I tried to get the same results using an http request in java :

try {
            URL url = new URL("http://10.60.74.134:9200/logstash-2015.04.09/_search?pretty'-d'{\"facets\":{\"terms\":{\"terms\":{\"field\":\"_type\",\"size\":10,\"order\":\"count\",\"exclude\":[]},\"facet_filter\":{\"fquery\":{\"query\":{\"filtered\":{\"query\":{\"bool\":{\"should\":[{\"query_string\":{\"query\":\"*\"}}]}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"@timestamp\":{\"from\":1428558001341,\"to\":1428579601341}}},{\"terms\":{\"_type\":[\"akaoatg-monitoring\"]}}]}}}}}}}},\"size\":0}");
            BufferedReader br = new BufferedReader(new InputStreamReader(url.openStream()));
            String strTemp;
            while((strTemp = br.readLine()) != null){
                System.out.println(strTemp);
            }
        } catch (Exception ex) {
            ex.printStackTrace();
        }

The URL I am using here is the cURL request formatted to fit in an http request. This request returns me a single String which does not contain the same result. here is a part of the java result :

   {"took":22,
"timed_out":false,
"_shards":{"total":5,
"successful":5,
"failed":0},
"hits":{"total":4621367,
"max_score":1.0,
"hits":[{"_index":"logstash-2015.04.09",
"_type":"xxx",
"_id":"xxx",
"_score":xxx,
"_source":{"@version":"xxx",
"@timestamp":"2015-04-09T01:09:59.347Z",
"host":"xxx",
"type":"xxx",
"sys_priority":"xxx",
"sys_timestamp":"xxx",
"logsource":"xxx",
"application":"xxx",
"year":"2015",
"month":"04",
"day":"09",
"hour":"01",
"minute":"09",
"second":"58",
"trace_level":"3",
"host_name":"xxx",
"adh_port":"xxx",
"timestamp_adh":1428541798954,
"time_adh":27,
"adh_uuid":"xxx",
"Service":"xxx",
"ReturnCode":"0",
"ErrorMessage":"null",
"Site":"null",
"BaseType":"null",
"PlatForm":"0",
"Cad_sender":"",
"Domain":"xxx",
"Freshness":"9",
"ClientProcessID":"xxx",
"CallMode":"S",
"SystemMode":"R",
"Sad_receiver":"",
"ConnectionType":"IP",
"DataFormat":"",
"HeaderType":"H4",
"AdhesionVersion":"null",
"Length":"10",
"ConnectionInfo":"null",
"ConnectionInfoKey":"null",
"Comments":"null",
"ActionCode":"null",
"TimeStamp":20150409010958,
"ServerProgramName":"null",
"TransactionCode":"null",
"TraceLevel":"null",
"LU":"null",
"HostName":"xxx",
"Port":"xxx",
"Timer":20,
"SendQueue":"null",
"ReturnQueue":"",
"PDM":"",
"RFU":"null",
"FTU":"",
"ActivationFlag":"null",
"HistoryQueue":"null",
"ErrorQueue":"null",
"CallReference":"xxx",
"IPAddress":"xxx",
"MessageType":"I",
"ProgramName":"null",
"UserName":"xxx",
"BeginTime":"24:00:00",
"EndTime":"24:00:00",
"duration":0,
"cnx_running":0,
"cnx_max":0}}]}}

Any idea of what I'm doing wrong ?

Answer 1

Your request sent via Java is malformed: there is no "facets": { "0": {...}} part in it. (At least the '0' is missing). Hence the server seems to ignore that part and just give you a bunch of raw entries (the default output)

Answer 2

The problem was the type of request, I had to send a POST request instead of a GET one. Used this code :

String url = "http://10.60.74.134:9200/logstash-2015.04.09/_search?pretty'-d'";
        URL obj = new URL(url);
        HttpURLConnection con = (HttpURLConnection) obj.openConnection();

        con.setRequestMethod("POST");
        con.setRequestProperty("User-Agent", USER_AGENT);
        con.setRequestProperty("Accept-Language", "en-US,en;q=0.5");

        String urlParameters = "{\"facets\":{\"0\":{\"date_histogram\":{\"field\":\"@timestamp\",\"interval\":\"5m\"},\"global\":true,\"facet_filter\":{\"fquery\":{\"query\":{\"filtered\":{\"query\":{\"query_string\":{\"query\":\"*\"}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"@timestamp\":{\"from\":1428558001338,\"to\":1428579601338}}},{\"terms\":{\"_type\":[\"akaoatg-monitoring\"]}}]}}}}}}}},\"size\":0}";

thanks to this tutorial