Question

我是弹性搜索的新手，它尝试使用以下条件查询我的存储日志：返回最近一小时的所有“致命”关卡字段。这是我运行的最后一个返回错误的代码：

    GET /eu-multitenant*/_search
{
  "query": 
  { "bool": {
    "should": [
        "match": {"level": "fatal" },
        "range": {"@timestamp": {"gte": "now-1h"}}
      ]
  }

  },
  "_source": ["d.Message","@timestamp"],
  "sort": { "@timestamp" : {"order" : "desc"}},
  "size": 100
}

这是错误：

  "error": {
    "root_cause": [
      {
        "type": "json_parse_exception",
        "reason": "Unexpected character (':' (code 58)): was expecting comma to separate Array entries\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@4be698a; line: 5, column: 17]"
      }
    ],

感谢您的帮助。

Answer 1

发布问题并找到我的错误后，我得到了一些启发。我没有用{}包围不同的查询条件。

GET /eu-multitenant*/_search
{
  "query": 
  { "bool": {
    "must": [
        {"match": {"level": "fatal" }},
        {"range": {"@timestamp": {"gte": "now-24h"}}}
      ]
  }

  },
  "_source": ["d.Message","@timestamp"],
  "sort": { "@timestamp" : {"order" : "desc"}},
  "size": 100
}

弹性搜索多条件查询

1 个答案: