Elasticsearch查询以从JSON获取属性的值

安德鲁

我已经在Elasticsearch中推送了一些数据。我正在使用Kibana检查链接到logs索引名称的所有数据以下是json数据的样子:

{
  "_index": "logs",
  "_type": "_doc",
  "_id": "122",
  "_version": 7,
  "_score": null,
  "_source": {
    "Data": {
      "DiskTotal": 62701268992,
      "DiskFree": 56609468416,
      "DiskStatus": "Normal",
      "Version": "2.0",
      "Ip": "192.168.0.106"
    },
    "Created": "2021-01-04T14:13:48.245760",
    "Customer": "demo1"
    
  },
  "fields": {
    "Data.UpTime": [
      "2021-01-04T14:10:05.000Z"
    ],
    "Created": [
      "2021-01-04T14:13:48.245Z"
    ]
  },
  "sort": [
    1609769628245
  ]
}

我想编写一个查询,该查询可以使我获得索引名称中的所有customerlogs谁能帮我这个忙。谢谢

响应:

{
  "took" : 242,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 325,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "customers" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "HF",
          "doc_count" : 155
        },
        {
          "key" : "HF3",
          "doc_count" : 144
        },
        {
          "key" : "HF2",
          "doc_count" : 24
        },
        {
          "key" : "HF1",
          "doc_count" : 2
        }
      ]
    }
  }
}

您可以通过在字段进行简单terms聚合来实现Customer(理想情况下,Customer.keyword如果存在)

{
  "size": 0,
  "aggs": {
    "customers": {
      "terms": {
        "field": "Customer.keyword",
        "size": 100
      }
    }
  }
}

本文收集自互联网,转载请注明来源。

如有侵权,请联系 [email protected] 删除。

编辑于
0

我来说两句

0 条评论
登录 后参与评论

相关文章