C# 使用API后搜索不返回日志

我想返回包含“level”：“error”的日志，该日志来自使用NEST的asp.net核心web api应用程序中的elasticsearch。我查看了api之后的搜索，并查看了其他资源以获取信息。在Kibana CLI上，我编写了以下内容：

GET elastic-search-app-log*/_search
{
  "size": 3000,
  "query": {
    "match": {
      "level": "Error"
    }
  },
  "search_after": [3000],
  "sort":[
    {"@timestamp": "asc"}
  ]
}

我只是将大小设置为随机大小，然后搜索每个3000个标记

因此，在.net方面，我尝试将其翻译为：

ESFieldsController

        private readonly IElasticClient _elasticClient;

        public ESFieldsController(IElasticClient elasticClient)
        {
            _elasticClient = elasticClient;
        }

        [HttpGet]
        public async Task<ESFields> Get()
        {
            var response = await _elasticClient.SearchAsync<ESFields>(s => s
                .Index("elastic-search-app-logs*")
                .Size(3000)
                .Query(q => q.Match(m => m.Field(f => f.Level == "error")))
                .SearchAfter(3000)
                .Sort(srt => srt
                      .Ascending(p => p.TimeStamp)));

            Console.WriteLine(response);
            
            return response?.Documents?.FirstOrDefault();
        }

但是，当我运行应用程序并出现swagger时，我尝试执行get cmd以查看它是否有效，但它不会返回包含

“level”：“error”

我的翻译是否有问题？

---

其他信息：

startup.cs

        public void ConfigureServices(IServiceCollection services)
        {

            services.AddControllers();
            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new OpenApiInfo { Title = "ESPractice", Version = "v1" });
            });

            // create a new node instance 
            var node = new Uri("http://localhost:9200");
            // settings instance for the node
            var settings = new ConnectionSettings(node);

            services.AddSingleton<IElasticClient>(new ElasticClient(settings));
        }

---

你能分享索引映射吗？@Rob请查看原始帖子的“附加信息”部分

        public void ConfigureServices(IServiceCollection services)
        {

            services.AddControllers();
            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new OpenApiInfo { Title = "ESPractice", Version = "v1" });
            });

            // create a new node instance 
            var node = new Uri("http://localhost:9200");
            // settings instance for the node
            var settings = new ConnectionSettings(node);

            services.AddSingleton<IElasticClient>(new ElasticClient(settings));
        }

    public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .UseSerilog((context, configuration) =>
                {
                    configuration.Enrich.FromLogContext()
                        .Enrich.WithMachineName()
                        .WriteTo.Console()
                        .WriteTo.Elasticsearch(
                            new ElasticsearchSinkOptions(new Uri(context.Configuration["ElasticConfiguration:Uri"]))
                            {
                               IndexFormat = $"{context.Configuration["ApplicationName"]}-logs-{context.HostingEnvironment.EnvironmentName?.ToLower().Replace(".", "-")}-{DateTime.UtcNow:yyyy-MM}",
                               AutoRegisterTemplate = true,
                            })
                        .Enrich.WithProperty("Environment", context.HostingEnvironment.EnvironmentName)
                        .ReadFrom.Configuration(context.Configuration);
                })
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup<Startup>();
                });
    }

{
  "ApplicationName": "elastic-search-app",
  "Serilog": {
    "MinimumLevel": {
      "Default": "Information",
      "Override": {
        "Microsoft": "Information",
        "System": "Warning"
      }
    }
  },
  "ElasticConfiguration": {
    "Uri": "http://localhost:9200"
  },
  "AllowedHosts": "*"
}