Elasticsearch查询字符串过滤模式

发布于 2025-02-10 06:26:53 字数 1113 浏览 1 评论 0原文

我想使用Elasticsearch查询查询过滤以下文档，

 {
        "_index" : "logs-000001",
        "_type" : "_doc",
        "_id" : "GkA5koEBhT9d1rYBb7_e",
        "_score" : null,
        "_source" : {
          "timestamp" : 1656015577105,
          "message" : "2022-06-23 20:19:37 +0000 [info]: #0 Faraday error: logs.input.app1-7594a7072372481283701560b4efc07:578087ee41d47354bae68162e1490c434fcb68631eb42a6c2fae953aaae61831",
          "ingestionTime" : 1656015581351,
          "eventId" : "36930381429816247681747540585230094267893920556028395521",
          "logGroup" : "logs-release200",
          "logStream" : "logs/kinesis/964da56be54b47fda012669544502f4b"
        }
      }

到目前为止我想出的是

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "default_field": "message",
            "query": "*[info]: #0 Faraday error:*"
          }
        }
      ]
    }
  }

我要过滤特定消息模式的查询字符串。我还带来了与模式不匹配的其他记录。不胜感激地完善查询的任何帮助。 tia

原文

I want to filter documents of the below kind with a elasticsearch query

 {
        "_index" : "logs-000001",
        "_type" : "_doc",
        "_id" : "GkA5koEBhT9d1rYBb7_e",
        "_score" : null,
        "_source" : {
          "timestamp" : 1656015577105,
          "message" : "2022-06-23 20:19:37 +0000 [info]: #0 Faraday error: logs.input.app1-7594a7072372481283701560b4efc07:578087ee41d47354bae68162e1490c434fcb68631eb42a6c2fae953aaae61831",
          "ingestionTime" : 1656015581351,
          "eventId" : "36930381429816247681747540585230094267893920556028395521",
          "logGroup" : "logs-release200",
          "logStream" : "logs/kinesis/964da56be54b47fda012669544502f4b"
        }
      }

Query I have come up with so far

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "default_field": "message",
            "query": "*[info]: #0 Faraday error:*"
          }
        }
      ]
    }
  }

I want to filter the query string for the particular message pattern. The query I have also brings other records that do not match the pattern. Any help in refining the query is appreciated. TIA

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

陌路黄昏 2025-02-17 06:26:53

您可以使用match_phrase elasticsearch查询在[info]中获取结果：＃0 faraday错误：在消息字段中匹配。

{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "[info]: #0 Faraday error:"
          }
        }
      ]
    }
  }
}

请注意，我从查询的启动和结尾删除了*。

You can use match_phrase query of Elasticsearch for getting result where [info]: #0 Faraday error: match in message field.

{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "[info]: #0 Faraday error:"
          }
        }
      ]
    }
  }
}

Please note that i have removed * from start and end of your query.

回复收藏 0 原文

破晓 2025-02-17 06:26:53

您可以尝试使用 - 它不使用分析仪，因此应正确匹配您

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "regexp": {
      "user.id": {
        "value": ".*[info]: #0 Faraday error:.*",
      }
    }
  }
}

query_string is searching the fields using an analyzer, this is why you will have results that have partial match for any of the words. Also it ignores white spaces and some special symbols for the same reason - they are used to split the searched string into list of words to search for.

You could try using regex - it does not use analyzer so it should match your regex correctly

GET logs/_search
{
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "query": {
    "regexp": {
      "user.id": {
        "value": ".*[info]: #0 Faraday error:.*",
      }
    }
  }
}

回复收藏 0 原文

~没有更多了~