如何在 Kibana(7.6) 中為嵌套文件編寫腳本字段

Question

我是 Elasticsearch 和 Kibana 的新手，我想編寫一個腳本字段來獲取嵌套字段值。 我嘗試了以下但沒有奏效。

doc['dadatas.datas_name.keyword:pressure'].value

我想獲取每個文檔（記錄）的壓力值。

output 應該是 12.56

我的文檔看起來像這樣。

提前致謝！！

{
  "_index":"process_data",
  "_type":"_doc",
  "_id":"UzFHVDM1MTAxMTk5QSAyMDAyMDAwOTUzN19TVDNBMjBfU1QzQTIwMTAwXzIwMjAtMDItMThUMTk6NDc6MzM=",
  "_version":1,
  "_score":1,
  "_source":{
    "eid":"",
    "line":"Line 1",
    "equipment":"Equipment 1",
    "ladderver":"",
    "registrydate":"2020-02-18T19:47:33",
    "registryutcdate":"2020-02-18T10:47:33",
    "setupid":"",
    "workid":"2345743",
    "datas":[
      {
        "datas_id":"001",
        "name":"cycletime",
        "value":"13.9"
      },
      {
        "datas_id":"002",
        "name":"machinetime",
        "value":"10.7"
      },
      {
        "datas_id":"003",
        "name":"pressure",
        "value":"12.56"
      }
    ]
  }
}

Answer 1

{
  "script_fields": {
    "pressure": {
      "script": {
        "source": "for(item in params._source.datas){ if(item.name=='pressure')return item.value;} return '';"
      }
    }
  }
}

腳本字段是即時計算的。 所以更好的選擇是從 inner_hits 中提取字段

詢問：

{
  "query": {
    "nested": {
      "path": "datas",
      "query": {
        "term": {
          "datas.name.keyword": {
            "value": "pressure"
          }
        }
      },
      "inner_hits": {}
    }
  }
}

結果：

"hits" : [
      {
        "_index" : "index5",
        "_type" : "_doc",
        "_id" : "kf6xw3EB8jeMa7x6RMwZ",
        "_score" : 0.9808291,
        "_source" : {
          "eid" : "",
          "line" : "Line 1",
          "equipment" : "Equipment 1",
          "ladderver" : "",
          "registrydate" : "2020-02-18T19:47:33",
          "registryutcdate" : "2020-02-18T10:47:33",
          "setupid" : "",
          "workid" : "2345743",
          "datas" : [
            {
              "datas_id" : "001",
              "name" : "cycletime",
              "value" : "13.9"
            },
            {
              "datas_id" : "002",
              "name" : "machinetime",
              "value" : "10.7"
            },
            {
              "datas_id" : "003",
              "name" : "pressure",
              "value" : "12.56"
            }
          ]
        },
        "inner_hits" : {
          "datas" : {
            "hits" : {
              "total" : {
                "value" : 1,
                "relation" : "eq"
              },
              "max_score" : 0.9808291,
              "hits" : [
                {
                  "_index" : "index5",
                  "_type" : "_doc",
                  "_id" : "kf6xw3EB8jeMa7x6RMwZ",
                  "_nested" : {
                    "field" : "datas",
                    "offset" : 2
                  },
                  "_score" : 0.9808291,
                  "_source" : {
                    "datas_id" : "003",
                    "name" : "pressure",
                    "value" : "12.56"
                  }
                }
              ]
            }
          }
        }
      }
    ]
  }

編輯1：我的答案是在開發工具中查詢對於索引模式腳本字段，您需要在下面添加

for(item in params._source.datas)
{
    if(item.name=='pressure'){
      return item.value;
   }
}
return 0;