elasticsearch-5,- elasticsearch/
elasticsearch 使用查询从elasticsearch日志消息中提取值
elasticsearch 使用查询从elasticsearch日志消息中提取值
我有一个ELK（v5.2.1）集群用于日志分析。我的索引有许多日志消息，其中一些消息包含有关结果代码的字符串。信息如下：
elasticsearch-5,
2017-03-28 20:35:14,518 [http-bio-8173-exec-3] INFO [soap] Outbound Message
ID: 2910
Response-Code: 200
Encoding: ISO-8859-1
Content-Type: application/soap+xml
Headers: {}
Payload: <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><env:Header xmlns:env="http://www.w3.org/2003/05/soap-envelope"/><soap:Body><syn:getActiveUserResponse xmlns:ns2="http://somecompany.com" xmlns:ns3="http://ws.myserver.com/unibssHead" xmlns:ns4="http://ws.myserver.com/InternationUser/anyappBody/syncRoamingTrafficInfoReq" xmlns:ns5="http://ws.myserver.com/InternationUser/anyappBody" xmlns:ns6="http://ws.myserver.com/unibssAttached" xmlns:ns7="http://ws.myserver.com/InternationUser/anyappBody/syncRoamingTrafficInfoRsp" xmlns:syn="http://somecompany.com"><Result>2012</Result><Description>Something wrong</Description><TransactionID>a0431</TransactionID><Count>0</Count></syn:getActiveUserResponse></soap:Body></soap:Envelope>
2017-03-28 20:35:14518[http-bio-8173-exec-3]信息[soap]出站消息
身份证号码：2910
响应代码：200
编码：ISO-8859-1
内容类型：应用程序/soap+xml
标题：{}
有效载荷：2012某些错误A04310
我试图从消息中提取