Question

我正在努力为Elastic Search制定正确的API搜索调用，该调用将在最近1小时内请求我想要的ipv4address。

首次尝试：

curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
     {
       "query": {
         "match": {
           "ipv4address": {
             "query": "50.167.71.25"
           }
         }
       },
       "range": {
         "@timestamp": {
           "gte": "now-1h",
           "lt": "now"
         }
       }
     }
     '

{“错误”：{“ root_cause”：[{“ type”：“ parsing_exception”，“ reason”：“ Unknown START_OBJECT中的键 [range]。“，” line“：10，” col“：12}]，” type“：” parsing_exception“，” reason“：”未知 START_OBJECT在[range]中的键。“，” line“：10，” col“：12}，” status“：400}

第二次尝试：

curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
{
   "query": {
     "match": {
       "ipv4address": {
         "query": "50.167.71.25"
       }
     }
   },
   "fields": {
    "range": {
     "@timestamp": {
      "gte": "now-1h",
      "lt": "now"
     }
   }
  }
 }
 '

{“错误”：{“ root_cause”：[{“ type”：“ parsing_exception”，“ reason”：“ Unknown START_OBJECT中的键 [fields]。“，” line“：10，” col“：14}]，” type“：” parsing_exception“，” reason“：”未知在[fields]中输入START_OBJECT的键。“，” line“：10，” col“：14}，” status“：400}

我在基巴纳州拥有什么

{
  "_index": "ipaddresses",
  "_type": "default",
  "_id": "TJdvR2UB9sEBYW4CrElF",
  "_version": 1,
  "_score": null,
  "_source": {
    "tags": [
      "blocked",
      "ipv4_address",
    ],
    "@version": "1",
    "@timestamp": "2018-08-17T10:30:25.118Z",
    "ipv4_metadata": {
      "host": "elk",
      "name": "blocks",
      "response_message": "OK",
      "code": 200,
      "times_retried": 0,
      "runtime_seconds": 0.066403,
      "response_headers": {
        "connection": "keep-alive",
        "x-frame-options": "sameorigin",
        "last-modified": "Fri, 17 Aug 2018 10:28:06 GMT",
        "keep-alive": "timeout=20",
        "date": "Fri, 17 Aug 2018 10:28:20 GMT",
        "content-type": "text/plain; charset=UTF-8",
        "server": "nginx/1.12.2",
        "transfer-encoding": "chunked",
        "etag": "W/\"5c7c5-5739f03f2997f\"",
        "cache-control": "public"
      }
    },
    "ipv4address": "50.167.71.25",
    "message": "50.167.71.25"
  },
  "fields": {
    "@timestamp": [
      "2018-08-17T10:30:25.118Z"
    ]
  },
  "sort": [
    1534501825118
  ]
}

查询出了什么问题？如果我也想寻找一个等于“封锁”的“标签”字段怎么办？

请帮助我将点连接起来。

Answer 1

此查询将返回最近1小时的文档：

{
   "query": {
     "range": {
       "@timestamp": {
         "gte": "now-1h",
         "lt": "now"
       }
     }
   }
 }

此查询将返回标记被阻止且距离最近1小时的文档：

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "tags": "blocked"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1d",
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}

您可以使用_source限制要返回的数据。

此查询将仅返回 ipv4地址。

{
  "_source": "ipv4address", 
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "tags": "blocked"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1d",
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}

如果您想应用更多查询，请查看this.

Elasticsearch时间范围查询和数据

1 个答案: