我收到此请求的对象: https://X.X.X.X:6200/somewhere-2019-08-12/_search?size=1
{
"_ddddsss": "dated55d",
"_tttt": "rr",
"_cccc": "ree",
"_aaaaa": 0.0,
"_bbbbbb": {
"destinationmac": "bb",
"tc": 0,
"type": "ALLOW",
"aaaaa": 1111111111111111111,
"f": "somethin",
"d": "5.5.5.5",
"source": "5",
"s": "5",
"m": "x",
"sourceip": "0.0.0.0",
"b": 5455555555555,
"obb2": {
"acl": "a2",
"pancake": "a2",
"a": "a2",
"yes": "a2",
"maybe": "a2",
"spgName": null,
"vrfId": "a2",
"sanem2": "a2",
"sane2": null,
"src-subnetmem": "a2",
"name2": "a2",
"name1": "somewhere",
"name": "a5",
"src-zonemem": "DL_ZONE",
"name222": "2957981673",
"name22222": "pp",
"something": [
{
"a": "6e",
"b": "Null",
"c": "Null"
}
],
"somehwer": "ch",
"wolcome": "br"
},
"some": {},
"timestamp": 1565589864000
}
}
现在,例如,如果我将size参数更改为10,我将收到10个这些对象。现在,我想选择所有时间戳值为1565589864000的对象,例如仅通过更改url并创建查询字符串即可。 我不知道如何为嵌套对象创建查询字符串。尝试了一些,更有意义的是这样的:
https://X.X.X.X:6200/somewhere-2019-08-12/_search?size=10&_source[timestamp]=1565589864000
但是它不起作用。欢迎任何帮助。