Elasticsearch时间范围查询和数据

Question

我正在努力为弹性搜索制定正确的API搜索调用，这将要求在过去1小时内获得我想要的ipv4address。

第一次尝试：

curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
     {
       "query": {
         "match": {
           "ipv4address": {
             "query": "50.167.71.25"
           }
         }
       },
       "range": {
         "@timestamp": {
           "gte": "now-1h",
           "lt": "now"
         }
       }
     }
     '

{“error”：{“root\u cause”：[{“type”：“parsing\u exception”，“reason”：“未知键，用于[范围]中的START\u对象。”，“line”：10，“col”：12}]，“type”：“parsing\u exception”，“reason”：“未知键，用于[范围]中的START\u对象。”，“行”：10，“列”：12}，“状态”：400}

第二次尝试：

curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
{
   "query": {
     "match": {
       "ipv4address": {
         "query": "50.167.71.25"
       }
     }
   },
   "fields": {
    "range": {
     "@timestamp": {
      "gte": "now-1h",
      "lt": "now"
     }
   }
  }
 }
 '

{"错误"：{"root_cause"：[{"type"："parsing_exception"，"原因"："[字段]中START_OBJECT的未知密钥."，"line"： 10，"coll"： 14}]，"type"："parsing_exception"，"原因"："[字段]中START_OBJECT的未知密钥."，"line"： 10，"coll"： 14}，"status"： 400}

我在基巴纳拥有：

{
  "_index": "ipaddresses",
  "_type": "default",
  "_id": "TJdvR2UB9sEBYW4CrElF",
  "_version": 1,
  "_score": null,
  "_source": {
    "tags": [
      "blocked",
      "ipv4_address",
    ],
    "@version": "1",
    "@timestamp": "2018-08-17T10:30:25.118Z",
    "ipv4_metadata": {
      "host": "elk",
      "name": "blocks",
      "response_message": "OK",
      "code": 200,
      "times_retried": 0,
      "runtime_seconds": 0.066403,
      "response_headers": {
        "connection": "keep-alive",
        "x-frame-options": "sameorigin",
        "last-modified": "Fri, 17 Aug 2018 10:28:06 GMT",
        "keep-alive": "timeout=20",
        "date": "Fri, 17 Aug 2018 10:28:20 GMT",
        "content-type": "text/plain; charset=UTF-8",
        "server": "nginx/1.12.2",
        "transfer-encoding": "chunked",
        "etag": "W/\"5c7c5-5739f03f2997f\"",
        "cache-control": "public"
      }
    },
    "ipv4address": "50.167.71.25",
    "message": "50.167.71.25"
  },
  "fields": {
    "@timestamp": [
      "2018-08-17T10:30:25.118Z"
    ]
  },
  "sort": [
    1534501825118
  ]
}

查询有什么问题？如果我还想查找一个等于blocked的“tag”字段，该怎么办？

请帮我把这些点连起来。

Answer 1

此查询将返回过去1小时的文档：

{
   "query": {
     "range": {
       "@timestamp": {
         "gte": "now-1h",
         "lt": "now"
       }
     }
   }
 }

此查询将返回标记被阻止的文档，这些文档来自最近1小时：

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "tags": "blocked"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1h",
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}

您可以使用_source限制要返回的数据。

此查询将仅返回ipv4address：

{
  "_source": "ipv4address", 
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "tags": "blocked"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1h",
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}

如果您想应用更多查询，请查看以下内容。