如何使用 Painless 拒绝 elasticsearch 索引结果中 json 数据类型列的值？

Question

我的问题很简单也很独特。我正在尝试从 elasticsearch 索引中的 json 字符串列中获取值。我怎样才能从下面的数据中得到 "ClassName"？

我的行是：

{
  "ClassName": "System.InvalidOperationException",
  "Message": "Sequence contains no elements",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "  . . . . . 
}

我的解决方案是

GET slog-2019-08-11/_search
{
  "script_fields": {
    "data": {
      "script": {
        "lang":   "expression",
        "source": "doc['ClassName']",
        "params": {
          "markup": 0.2
        }
      }
    }
  }
}

但它 returns 对我来说是一个错误：

{
  "error": {
    "root_cause": [
      {
        "type": "script_exception",
        "reason": "link error",
        "script_stack": [
          "doc['ClassName']",
          "     ^---- HERE"
        ],
        "script": "doc['ClassName']",
        "lang": "expression"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "slog-2019-08-11",
        "node": "TBSUPCkhQ1aHX069zwT7Tg",
        "reason": {
          "type": "script_exception",
          "reason": "link error",
          "script_stack": [
            "doc['ClassName']",
            "     ^---- HERE"
          ],
          "script": "doc['ClassName']",
          "lang": "expression",
          "caused_by": {
            "type": "parse_exception",
            "reason": "Field [ClassName] does not exist in mappings"
          }
        }
      }
    ]
  },
  "status": 500
}

Answer 1

你试过这个语法吗？:

"source": "doc['ClassName'].value",

如何使用 Painless 拒绝 elasticsearch 索引结果中 json 数据类型列的值？

How can I reject a value from json data type column in elasticsearch index result by using Painless?

logging

elasticsearch

kibana

elasticsearch-painless

elk