Question

我在3节点集群上安装了elasticsearch 2.1.1。以下是我的2种类型的索引

{
"log-aggregation": {
    "mappings": {
        "application-logs": {
            "_all": {
                "enabled": true
            },
            "_parent": {
                "type": "webserver-logs"
            },
            "_routing": {
                "required": true
            },
            "properties": {
                "localhost": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                },
                "log_level": {
                    "type": "string",
                    "include_in_all": true
                },
                "logging_class": {
                    "type": "string",
                    "include_in_all": true
                },
                "logging_message": {
                    "type": "string",
                    "index": "no",
                    "include_in_all": true
                },
                "origin": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                },                    
                "request_date": {
                    "type": "date",
                    "format": "YYYY-MM-dd HH:mm:ss,SSS",
                    "include_in_all": true
                },
                "request_time": {
                    "type": "long",
                    "include_in_all": true
                },
                "request_timestamp": {
                    "type": "date",
                    "format": "epoch_millis",
                    "include_in_all": true
                },
                "response_time": {
                    "type": "string"
                },
                "response_timestamp": {
                    "type": "date",
                    "format": "epoch_millis",
                    "include_in_all": true
                },
                "unique_id": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                }
            }
        },
        "webserver-logs": {
            "_all": {
                "enabled": true
            },
            "_routing": {
                "required": true
            },
            "properties": {
                "accept_type": {
                    "type": "string",
                    "index": "no",
                    "include_in_all": true
                },
                "content_type": {
                    "type": "string",
                    "index": "no",
                    "include_in_all": true
                },
                "http_method": {
                    "type": "string",
                    "include_in_all": true
                },
                "http_protocol": {
                    "type": "string"
                },
                "http_status": {
                    "type": "long",
                    "index": "analyzed",
                    "include_in_all": true
                },
                "http_url": {
                    "type": "string"
                },
                "localhost": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                },
                "origin": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                },
                "referrer": {
                    "type": "string",
                    "index": "no",
                    "include_in_all": true
                },
                "request_timestamp": {
                    "type": "date",
                    "format": "epoch_millis",
                    "include_in_all": true
                },
                "response_size": {
                    "type": "short",
                    "index": "no",
                    "include_in_all": true
                },
                "timestamp": {
                    "type": "string"
                },
                "unique_id": {
                    "type": "string",
                    "index": "not_analyzed",
                    "include_in_all": true
                },
                "useragent": {
                    "type": "string",
                    "index": "no",
                    "include_in_all": true
                }
            }
        }
    }
}

}

以下是我编入索引的文件。

在http://SERVERNAME:9200/log-aggregation/webserver-logs?routing=VlN6VQoEFHAAAEcxAUUAAAAC

发帖

“localhost”：“svcdev104.imagitas.com”， “origin”：“10.4.30.112”， “unique_id”：“VlN6VQoEFHAAAEcxAUUAAAAC”， “timestamp”：“1448311381504”， “http_method”：“POST”， “http_url”：“/ registration / v1 / save”， “http_protocol”：“HTTP / 1.1”， “http_status”：“500”， “response_size”：“137”， “accept_type”：“application / json”， “content_type”：“application / json”， “推荐人”：“ - ”， “useragent”：“Mozilla / 5.0（Windows NT 6.1; WOW64）AppleWebKit / 537.36（KHTML，与Gecko一样）Chrome / 46.0.2490.86 Safari / 537.36” }

POST http://SERVERNAME:9200/log-aggregation/application-logs?routing=VlN6VQoEFHAAAEcxAUUAAAAC&parent=VlN6VQoEFHAAAEcxAUUAAAAC

“localhost”：“svcdev104.imagitas.com”， “origin”：“chrome-extension：// aejoelaoggembcahagimdiliamlcdmfm”， “unique_id”：“VlN6VQoEFHAAAEcxAUUAAAAC”， “request_timestamp”：“1448311331605”， “response_timestamp”：“1448311381609”， “response_time”：“4”， “request_date”：“2015-11-23 12：53：01,605”， “log_level”：“WARN”， “logging_class”：“LoggingResponseInterceptor”， “logging_message”：“注册数据持久性失败......” }

现在，我正在运行has_child和has_parent查询，但没有得到任何结果。我查询每种类型并获得结果，但不是当我运行has_child和has_parent查询时

以下是示例查询发布http://SERVERNAME:9200/log-aggregation/application-logs/_search

“查询”：{ “has_parent”：{ “type”：“webserver-logs”， “查询”：{ “比赛”： { “http_status”：“500” } } } } }

任何帮助都将受到高度赞赏。谢谢斯

Answer 1

您需要设置父级的_id，否则孩子不会映射到父级。

因此，您的第一个文档插件应如下所示：

POST http://SERVERNAME:9200/log-aggregation/webserver-logs/VlN6VQoEFHAAAEcxAUUAAAAC/?routing=VlN6VQoEFHAAAEcxAUUAAAAC
{
   "localhost": "svcdev104.imagitas.com",
   "origin": "10.4.30.112",
   "unique_id": "VlN6VQoEFHAAAEcxAUUAAAAC",
   "timestamp": "1448311381504",
   "http_method": "POST",
   "http_url": "/registration/v1/save",
   "http_protocol": "HTTP/1.1",
   "http_status": "500",
   "response_size": "137",
   "accept_type": "application/json",
   "content_type": "application/json",
   "referrer": "-",
   "useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36"
}

然后你的查询就可以了。

以下是我用来测试它的代码：

http://sense.qbox.io/gist/ff5d4fcd6bca62853f2d506e0b81a7290ee727d7

has_parent和has_child查询始终返回空结果：ElasticSearch 2.1.1

1 个答案: