在 elasticsearch 中使用正则表达式进行搜索
searching with regex in elasticsearch
我正在尝试使用正则表达式搜索 elasticsearch 数据库。
到目前为止我的查询(它不工作):
#!/usr/bin/env bash
curl -XGET 'http://localhost:9200/logstash-2015.10.27/_search' -d \
'{
query: {
"regexp": {
"@timestamp": {
value: ".*"
}
}
}
}' | python -m json.tool
我得到的结果是
{
"error": "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][0]: SearchParseException[[logstash-2015.10.27][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][1]: SearchParseException[[logstash-2015.10.27][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][2]: SearchParseException[[logstash-2015.10.27][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][3]: SearchParseException[[logstash-2015.10.27][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][4]: SearchParseException[[logstash-2015.10.27][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }]",
"status": 400
}
我要查找的事件是这个
{
"_index": "logstash-2015.10.27",
"_type": "logs",
"_id": "AVCml4MI2xxzjEtiGou0",
"_version": 1,
"_score": null,
"_source": {
"host": "server",
"@timestamp": "2015-10-27T00:00:00.142Z",
"type_instance": "free",
"plugin": "exec",
"plugin_instance": "available_memory",
"collectd_type": "gauge",
"value": 855,
"@version": "1"
},
"sort": [
1445904000142
]
}
我用谷歌搜索了一些东西,但 w/o 祝你好运。
========更新==========
我设法用这个查询了我的 elasticsearch
#!/usr/bin/env bash
curl -XPOST 'http://localhost:9200/logstash-2015.10.27/_search' -d '
{
"query": {
"bool": {
"must": { "range" : { "@timestamp" : { "gte" : "2015-10-27T00:00:01", "lte" : "2015-10-27T00:00:59"} }},
"must": {"regexp" : { "host": "d027.*" }}
}
}
}'
regexp
适用于 string
字段。 date
字段实际上是 Elasticsearch 中的数字。
对于 date
搜索,我推荐 range
过滤器:https://www.elastic.co/guide/en/elasticsearch/guide/current/_ranges.html#_ranges_on_dates
我正在尝试使用正则表达式搜索 elasticsearch 数据库。
到目前为止我的查询(它不工作):
#!/usr/bin/env bash
curl -XGET 'http://localhost:9200/logstash-2015.10.27/_search' -d \
'{
query: {
"regexp": {
"@timestamp": {
value: ".*"
}
}
}
}' | python -m json.tool
我得到的结果是
{
"error": "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][0]: SearchParseException[[logstash-2015.10.27][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][1]: SearchParseException[[logstash-2015.10.27][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][2]: SearchParseException[[logstash-2015.10.27][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][3]: SearchParseException[[logstash-2015.10.27][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }{[DqJwlMoTQ3e8nyl4m7amGw][logstash-2015.10.27][4]: SearchParseException[[logstash-2015.10.27][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n query: {\n \"regexp\": {\n \"@timestamp\": {\n value: \".*\"\n }\n }\n }\n}]]]; nested: IllegalArgumentException[Invalid format: \".*\"]; }]",
"status": 400
}
我要查找的事件是这个
{
"_index": "logstash-2015.10.27",
"_type": "logs",
"_id": "AVCml4MI2xxzjEtiGou0",
"_version": 1,
"_score": null,
"_source": {
"host": "server",
"@timestamp": "2015-10-27T00:00:00.142Z",
"type_instance": "free",
"plugin": "exec",
"plugin_instance": "available_memory",
"collectd_type": "gauge",
"value": 855,
"@version": "1"
},
"sort": [
1445904000142
]
}
我用谷歌搜索了一些东西,但 w/o 祝你好运。
========更新==========
我设法用这个查询了我的 elasticsearch
#!/usr/bin/env bash
curl -XPOST 'http://localhost:9200/logstash-2015.10.27/_search' -d '
{
"query": {
"bool": {
"must": { "range" : { "@timestamp" : { "gte" : "2015-10-27T00:00:01", "lte" : "2015-10-27T00:00:59"} }},
"must": {"regexp" : { "host": "d027.*" }}
}
}
}'
regexp
适用于 string
字段。 date
字段实际上是 Elasticsearch 中的数字。
对于 date
搜索,我推荐 range
过滤器:https://www.elastic.co/guide/en/elasticsearch/guide/current/_ranges.html#_ranges_on_dates