Question

我在Kibana中有一条包含以下内容的日志消息：

org.hibernate.exception.GenericJDBCException: Cannot open connection
at org.springframework.orm.hibernate3.HibernateTransactionManager.doBegin(HibernateTransactionManager.java:597)

不返回结果的实际搜索：log_message：＆＃34; hibernate3＆＃34;

如果我搜索＆＃34; hibernate3＆＃34;此消息不会出现。我正在使用Elasticsearch模板并对该字段编制索引，但也希望能够进行不区分大小写的全文搜索。这可能吗？

正在使用的模板：

{
"template": "filebeat-*",
"mappings": {
    "mainProgram": {
        "properties": {
            "@timestamp": {
                "type": "date",
                "format": "strict_date_optional_time||epoch_millis"
            },
            "@version": {
                "type": "text"
            },
            "beat": {
                "properties": {
                    "hostname": {
                        "type": "text"
                    },
                    "name": {
                        "type": "text"
                    }
                }
            },
            "class_method": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "class_name": {
                "type": "text",
                "fielddata": "true"
            },
            "clientip": {
                "type": "ip",
                "index": "not_analyzed"
            },
            "count": {
                "type": "long"
            },
            "host": {
                "type": "text",
                "index": "not_analyzed"
            },
            "input_type": {
                "type": "text",
                "index": "not_analyzed"
            },
            "log_level": {
                "type": "text",
                "fielddata": "true",
                "index": "true"
            },
            "log_message": {
                "type": "text",
                "index": "true"
            },
            "log_timestamp": {
                "type": "text"
            },
            "log_ts": {
                "type": "long",
                "index": "not_analyzed"
            },
            "message": {
                "type": "text"
            },
            "offset": {
                "type": "long",
                "index": "not_analyzed"
            },
            "query_params": {
                "type": "text",
                "index": "true"
            },
            "sessionid": {
                "type": "text",
                "index": "true"
            },
            "source": {
                "type": "text",
                "index": "not_analyzed"
            },
            "tags": {
                "type": "text"
            },
            "thread": {
                "type": "text",
                "index": "true"
            },
            "type": {
                "type": "text"
            },
            "user_account_combo": {
                "type": "text",
                "index": "true"
            },
            "version": {
                "type": "text"
            }
        }
    },
    "access": {
        "properties": {
            "@timestamp": {
                "type": "date",
                "format": "strict_date_optional_time||epoch_millis"
            },
            "@version": {
                "type": "text"
            },
            "beat": {
                "properties": {
                    "hostname": {
                        "type": "text"
                    },
                    "name": {
                        "type": "text"
                    }
                }
            },
            "clientip": {
                "type": "ip",
                "index": "not_analyzed"
            },
            "count": {
                "type": "long",
                "index": "not_analyzed"
            },
            "host": {
                "type": "text",
                "index": "true"
            },
            "input_type": {
                "type": "text",
                "index": "not_analyzed"
            },
            "log_timestamp": {
                "type": "text"
            },
            "log_ts": {
                "type": "long",
                "index": "not_analyzed"
            },
            "message": {
                "type": "text"
            },
            "offset": {
                "type": "long",
                "index": "not_analyzed"
            },
            "query_params": {
                "type": "text",
                "index": "true"
            },
            "response_time": {
                "type": "long"
            },
            "sessionid": {
                "type": "text",
                "index": "true"
            },
            "source": {
                "type": "text",
                "index": "not_analyzed"
            },
            "statuscode": {
                "type": "long"
            },
            "tags": {
                "type": "text"
            },
            "thread": {
                "type": "text",
                "index": "true"
            },
            "type": {
                "type": "text",
                "index": "true"
            },
            "uripath": {
                "type": "text",
                "index": "true"
            },
            "user_account_combo": {
                "type": "text",
                "index": "true"
            },
            "verb": {
                "type": "text",
                "index": "true"
            }
        }
    }
}
}

Answer 1

根据您的方案，您正在寻找的是已分析的类型string，它首先会分析字符串然后将其编入索引。引自doc。

换句话说，将此字段编入全文。

因此请确保您已正确映射必要字段，以便您能够在文档上执行全文搜索。

假设Kibana如果日志行位于字段message下，则可以通过以下方式搜索单词：

message:"hibernate3"

您可能还想引用this，以确定Term Based和Full-Text之间的差异。

修改

具有字段log_message的映射：

"log_message": { "type": "string", <- to make it analyzed "index": "true" }

同时尝试执行通配符搜索：

{"wildcard":{"log_message":"*.hibernate3.*"}}

希望这有帮助！

Answer 2

message: *.hibernate3.*

也可以使用（请注意，不需要引号）

Kibana：在文本中搜索字符串

2 个答案: