Question

Elasticsearch newb here。我似乎在某个领域选择文档时遇到问题。对我来说这感觉像是一个腐败的指数，但我不确定。

以下是我可以检索的文档，并获取字段event.type和event.accountId：

$ curl -XGET 'http://127.0.0.1:9200/events-2015.04.08/event/AUyYpkl-r99VdGrSLpIX?pretty=1&fields=event.type,event.accountId'
{
  "_index" : "events-2015.04.08",
  "_type" : "event",
  "_id" : "AUyYpkl-r99VdGrSLpIX",
  "_version" : 1,
  "found" : true,
  "fields" : {
    "event.type" : [ "USER_LOGIN" ],
    "event.accountId" : [ 10399 ]
  }
}

注意event.type: USER_LOGIN。现在我想查找具有此字段/值组合的所有文档：

curl -XGET 'http://127.0.0.1:9200/events-2015.04.08/_search?q=event.type:USER_LOGIN&pretty=1'
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

没有结果。我可以通过event.accountId找到该文档：

$ curl -XGET 'http://127.0.0.1:9200/events-2015.04.08/_search?q=event.accountId:10399&pretty=1'
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 2,
    "max_score" : 1.0,
    "hits" : [ {
      "_index" : "events-2015.04.08",
      "_type" : "event",
      "_id" : "AUyYpkjCr99VdGrSLpIW",
      "_score" : 1.0,
      "_source": {...}
    }, {
      "_index" : "events-2015.04.08",
      "_type" : "event",
      "_id" : "AUyYpkl-r99VdGrSLpIX",  # <-- This is the doc I want
      "_score" : 1.0,
      "_source": {...}
    } ]
  }
}

这个领域是腐败还是什么？我该如何检查？我希望能够通过event.type找到这份文件。

更新

该文档正在使用Logstash的SQS插件编制索引。以下是logstash.conf的相关部分：

input {
  sqs {
    queue => "the_queue"
    region => "us-west-2"
    type => "event"
  }
}
filter {
  json {
    source => "Message"
    target => "event"
    remove_field => [ "Message" ]
  }
  mutate {
    rename => { "Type" => "EventType" }
  }
  date {
    match => [ "Timestamp", "ISO8601" ]
  }
}

Elasticsearch不按字段名称返回文档

0 个答案: