弹性搜索中特定字段的过滤查询

Question

我有一份这样的文件

  {
    _index: "logstash-2015.11.30",
    _type: "hadoopgeneric",
    _id: "AVFVsF6ypMu_z_qvIUgL",
    _score: null,
    _source: {
             @timestamp: "2015-11-30T00:00:00.017Z",
             message: "selector : 48 - Element found for using multiple selectors using query .js-product-brand.product-brand",
             @version: "1",
             host: "ip-x-x-x-x",
             path: "/logs/stats/container/application_1448508514184_0178/container_e06_1448508514184_0178_01_003568/stderr",
             type: "hadoopgeneric",
             thread_id: "15119",
             thread_name: "MainThread",
             component_name: "Page",
             severity: "DEBUG",
             env: "STG",
             role: "spider",
             ip: "x.x.x.x",
             tags: [
                 "processed"
             ]
            },
   }

下面是我到目前为止所尝试的

esurl = http://localhost:9200/logstash-*/_search
r = requests.post(esurl,data={"term":{'path':'/logs/stats/container/application_1448508514184_0178/container_e06_1448508514184_0178_01_003568/stderr'}})
r.text

{“错误”：“SearchPhaseExecutionException[未能执行阶段[query],所有碎片失败；shardFailures{[5D_RNDQPRF6XYLO1SUIOCA][LogStash-2015.11.30][0]:RemoteTransportException[[ip-x-x-x-x-elkstorage][Inet[/X.X.X.X:9300]][索引：数据/读取/搜索[phase/query]]]；嵌套：SearchParseException[[LogStash-2015.11.30][0]:From[-1],size[-1]:解析VE xcontent]；}{[o8jLb8P5SWOfsCo78eUlHg][LogStash-2015.12.01][0]:RemoteTransportException[[IP-X-X-X-X-X-ELKStorage][Inet[/X.X.X:9300]][Indexes:Data/Read/Search[phase/query]]]；嵌套：SearchParseException[[LogStash-2015.12.01][0]:From[-1],size[-1]:解析失败[未能解析源[_NA_]]]；嵌套：




Answer 1

q参数似乎是错误的(“字符位于错误的位置），请尝试以下操作：

http://localhost:9200/logstash-*/_search?pretty=true&q=path:"/logs/stats/container/application_1448508514184_0178/container_e06_1448508514184_0178_01_003568/stderr"&sort=@timestamp&size=100000

另一方面，术语query是有效的，但它必须在query键中，类似于：

import requests
import json

esurl = "http://localhost:9200/logstash-*/_search"
r = requests.post(esurl,data=json.dumps({"query": {"term":{'path':'/logs/stats/container/application_1448508514184_0178/container_e06_1448508514184_0178_01_003568/stderr'}}}))
r.text