Question

现在我正在使用＆＃34; match_all＆＃34;查询以获取Logstash正在处理的数据。我得到的输出是每个单独的字段，它应该是事件的一部分。这是我的疑问：

{
"query": {
    "match_all" : { }
},
  "size": 1,
  "sort": [
{
 "@timestamp": {
     "order": "desc"
  }
  }
  ]
}

正如你所看到的，我也在整理我的结果，我总是得到最新的输出结果。

以下是我的输出示例：

{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 15768,
    "max_score" : null,
    "hits" : [
      {
        "_index" : "filebeat-2017.02.24",
        "_type" : "bro",
        "_id" : "AVpx-pFtiEtl3Zqhg8tF",
        "_score" : null,
        "_source" : {
          "resp_pkts" : 0,
          "source" : "/usr/local/bro/logs/current/conn.log",
          "type" : "bro",
          "id_orig_p" : 56058,
          "duration" : 848.388112,
          "local_resp" : true,
          "uid" : "CPndOf4NNf9CzTILFi",
          "id_orig_h" : "192.168.137.130",
          "conn_state" : "OTH",
          "@version" : "1",
          "beat" : {
            "hostname" : "localhost.localdomain",
            "name" : "localhost.localdomain",
            "version" : "5.2.0"
          },
          "host" : "localhost.localdomain",
          "id_resp_h" : "192.168.137.141",
          "id_resp_p" : 22,
          "resp_ip_bytes" : 0,
          "offset" : 115612,
          "orig_bytes" : 32052,
          "local_orig" : true,
          "input_type" : "log",
          "orig_ip_bytes" : 102980,
          "orig_pkts" : 1364,
          "missed_bytes" : 0,
          "history" : "DcA",
          "tunnel_parents" : [ ],
          "message" : "{\"ts\":1487969779.653504,\"uid\":\"CPndOf4NNf9CzTILFi\",\"id_orig_h\":\"192.168.137.130\",\"id_orig_p\":56058,\"id_resp_h\":\"192.168.137.141\",\"id_resp_p\":22,\"proto\":\"tcp\",\"duration\":848.388112,\"orig_bytes\":32052,\"resp_bytes\":0,\"conn_state\":\"OTH\",\"local_orig\":true,\"local_resp\":true,\"missed_bytes\":0,\"history\":\"DcA\",\"orig_pkts\":1364,\"orig_ip_bytes\":102980,\"resp_pkts\":0,\"resp_ip_bytes\":0,\"tunnel_parents\":[]}",
          "tags" : [
            "beats_input_codec_plain_applied"
          ],
          "@timestamp" : "2017-02-24T21:15:29.414Z",
          "resp_bytes" : 0,
          "proto" : "tcp",
          "fields" : {
            "sensorType" : "networksensor"
          },
          "ts" : 1.487969779653504E9
        },
        "sort" : [
          1487970929414
        ]
      }
    ]
  }
}

正如您所看到的，这是在外部应用程序中处理的 lot 输出（用C＃编写，所以垃圾收集在所有这些字符串上都很庞大），我只是在＆＃39 ;需要。

我的问题是，如何设置我的查询，以便我只抓取我需要的字段？

Answer 1

对于5.x，有一项更改允许您进行<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script> <script src="https://netdna.bootstrapcdn.com/bootstrap/3.0.0/js/bootstrap.min.js"></script> <link href="https://netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.min.css" rel="stylesheet"/> <div id="tree"> <ul class="list-group"> <li class="list-group-item node-tree" data-nodeid="0" style="color:undefined;background-color:undefined;"><span class="icon expand-icon glyphicon glyphicon-minus"></span><span class="icon node-icon"></span><a href="#" style="color:inherit;">Test</a><span class="badge">123</span><span class="badge">123</span><span class="badge">3223</span><span class="badge">23</span><span class="badge">323</span></li> <li class="list-group-item node-tree" data-nodeid="0" style="color:undefined;background-color:undefined;"><span class="icon expand-icon glyphicon glyphicon-minus"></span><span class="icon node-icon"></span><a href="#" style="color:inherit;">Test 1</a><span class="badge">321</span><span class="badge">123</span><span class="badge">3223</span><span class="badge">23</span><span class="badge">323</span></li> </ul> </div>过滤。该文档是here，它看起来像这样：

_source

结果如下：

{ 
 "query": {
   "match_all" : { }
 },
 "size": 1,
 "_source": ["a","b"],
 ...

对于5之前的版本，您可以使用字段参数：

您的查询可以在查询的根级别传递{ "took" : 2, "timed_out" : false, "_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 1, "max_score" : 1.0, "hits" : [ { "_index" : "xxx", "_type" : "xxx", "_id" : "xxx", "_score" : 1.0, "_source" : { "a" : 1, "b" : "2" } } ] } }。它返回的格式将有所不同，但它会起作用。

,"fields": ["field1","field2"...]

这将产生如下输出：

{ 
"query": {
  "match_all" : { }
},
"size": 1,
"fields": ["a","b"],
...

这些字段总是数组（因为1.0 API）并且没有任何方法可以改变它，因为Elasticsearch本身就具有多值意识。

如何通过curl查询Logstash并仅返回特定字段

1 个答案: