[英]Elasticsearch query with different fields
这是我的文件的一个例子
{
"@timestamp": "2020-04-24T19:36:52.484Z",
"token": "123",
"application": "sso_api_v3",
"ssoapiv3_method": "GET",
"ssoapiv3_error_description": "Your access token has expired",
"code": 401,
"message": "\"message\"",
"level": 6,
"facility": "sso_api_v3",
"type": "gelf"
}
[...]
{
"@timestamp": "2020-04-24T19:37:52.484Z",
"token": "123",
"application": "sso_api_v3",
"ssoapiv3_method": "GET",
"ssoapiv3_error_description": "Your access token has expired",
"code": 200,
"message": "\"message\"",
"level": 6,
"facility": "sso_api_v3",
"type": "gelf"
}
[...]
我有大量请求,我想进行搜索以获取具有相同令牌但代码为 200 和 401 的文档。我可以获得全部 200、全部 401,但我无法为同一个令牌。
有两种方法可以做到这一点。
1. 术语聚合
询问:
{
"size": 0,
"aggs": {
"code": {
"filter": {
"terms": {
"code": [
200,401 --> returns all documengts with code 200 / 401
]
}
},
"aggs": {
"token": { --> creates group of tokens and fetched doc under each
"terms": {
"field": "token.keyword",
"size": 10
},
"aggs": {
"docs": {
"top_hits": {
"size": 10
}
}
}
}
}
}
}
}
结果:
"aggregations" : {
"code" : {
"doc_count" : 1,
"token" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "123",
"doc_count" : 1,
"docs" : {
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "index9",
"_type" : "_doc",
"_id" : "16UKynEBAWHHnYGORq-d",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2020-04-24T19:36:52.484Z",
"token" : "123",
"application" : "sso_api_v3",
"ssoapiv3_method" : "GET",
"ssoapiv3_error_description" : "Your access token has expired",
"code" : 401,
"message" : """"message"""",
"level" : 6,
"facility" : "sso_api_v3",
"type" : "gelf"
}
}
]
}
}
}
]
}
}
}
2. 场塌陷
返回组字段的前 1 个文档。 您可以使用 inner_hits 获取该组下的其他文档
询问:
{
"query": {
"terms": {
"code": [
200,
401
]
}
},
"collapse": {
"field": "token.keyword",
"inner_hits": {
"name": "docs",
"size": 10,
"sort": [{ "@timestamp": "asc" }]
}
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.