Question

我正在尝试使用elasticsearch python API对ELK设置进行搜索。似乎默认情况下，搜索仅返回索引的5个结果。我如何配置它，以便它可以返回索引中可用的所有分片？ kibanna仪表板显示900 +分片，但API仅返回5.我的代码目前是：

es = Elasticsearch([{'host': 'localhost', 'port': 9200}])

data = es.search(
    index='scapy'
)

脚本输出显示（顶部）：

{u'_shards': {u'failed': 0, u'skipped': 0, u'successful': 5, u'total': 5},

kibanna仪表板截图：

谢谢！

Answer 1

可以设置可选参数大小以显示更多结果

count = es.count(index='scapy')['count']
data = es.search(index='scapy', size=count)

Answer 2

你必须弄错才能理解结果，结果

{u'_shards': {u'failed': 0, u'skipped': 0, u'successful': 5, u'total': 5}

表示索引'scapy'的数据位于5个不同的分片中，您的搜索查询得到了这5个不同分片的结果。
所以结果必须如下：

{
  "took": 1651,
  "timed_out": false,
  "_shards": {
    "total": 10,
    "successful": 10,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 2221327255,
    "max_score": 1,
    "hits": [
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "BL1E-F8BH3R02gVcxkPc",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.1"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "Cr1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.1"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "Eb1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "F71E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "KL1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "LL1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "NL1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "R71E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "Sb1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      },
      {
        "_index": "test_index",
        "_type": "logs",
        "_id": "TL1E-F8BH3R02gVcxkPd",
        "_score": 1,
        "_source": {
          "deviceType": "4",
          "appVersion": "2.1.2"
        }
      }
    ]
  }
}

hits中有10个项目，这是因为结果返回的默认大小为10，因此您可以在查询dsl中设置大小，

GET /_search
{
    "from" : 0, "size" : 10,
    "query" : {
        "term" : { "user" : "kimchy" }
    }
}

使用Elasticsearch Python API时，如何返回所有分片？

2 个答案: