elasticsearch Kibana中的查询不'；t使用Regexp返回日志

我在Elasticsearch中有一个名为

log.file.path

的字段，它有

/var/log/dev collateral/uaa.2020-09-26.log

值，我试图检索

log.file.path

字段以

/var/log/dev collateral/uaa

开头的所有日志 我使用了下面的regexp，但它不起作用

{
    "regexp":{
        "log.file.path": "/var/log/dev-collateral/uaa.*"
    }
}

GET myindex/_search
{
  "query": {
    "match": {
      "log.file.path": "var"
    }
  }
}

---

让我们看看为什么它不起作用？我已经使用Kibana UI为两个文档编制了索引，如下所示-

PUT myindex/_doc/1
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.log"
}

PUT myindex/_doc/2
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.txt"
}

当我尝试使用

\u analyze

API查看

log.file.path

字段中文本的标记时

POST _analyze
{
  "text": "/var/log/dev-collateral/uaa.2020-09-26.log"
}

它给了我

{
  "tokens" : [
    {
      "token" : "var",
      "start_offset" : 1,
      "end_offset" : 4,
      "type" : "<ALPHANUM>",
      "position" : 0
    },
    {
      "token" : "log",
      "start_offset" : 5,
      "end_offset" : 8,
      "type" : "<ALPHANUM>",
      "position" : 1
    },
    {
      "token" : "dev",
      "start_offset" : 9,
      "end_offset" : 12,
      "type" : "<ALPHANUM>",
      "position" : 2
    },
    {
      "token" : "collateral",
      "start_offset" : 13,
      "end_offset" : 23,
      "type" : "<ALPHANUM>",
      "position" : 3
    },
    {
      "token" : "uaa",
      "start_offset" : 24,
      "end_offset" : 27,
      "type" : "<ALPHANUM>",
      "position" : 4
    },
    {
      "token" : "2020",
      "start_offset" : 28,
      "end_offset" : 32,
      "type" : "<NUM>",
      "position" : 5
    },
    {
      "token" : "09",
      "start_offset" : 33,
      "end_offset" : 35,
      "type" : "<NUM>",
      "position" : 6
    },
    {
      "token" : "26",
      "start_offset" : 36,
      "end_offset" : 38,
      "type" : "<NUM>",
      "position" : 7
    },
    {
      "token" : "log",
      "start_offset" : 39,
      "end_offset" : 42,
      "type" : "<ALPHANUM>",
      "position" : 8
    }
  ]
}

如果您尝试这种方法，它将起作用，但对于您的情况，您需要匹配以.log结尾的每个log.file.path，那么现在该怎么办？只是在索引文档时不要应用分析器。关键字类型按原样存储您提供的字符串

使用

关键字创建映射

类型，

PUT myindex2/
{
  "mappings": {
    "properties": {
      "log.file.path": {
        "type": "keyword"
      }
    }
  }
}

PUT myindex2/_doc/1
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.log"
}

PUT myindex2/_doc/2
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.txt"
}

索引文档，

PUT myindex2/
{
  "mappings": {
    "properties": {
      "log.file.path": {
        "type": "keyword"
      }
    }
  }
}

PUT myindex2/_doc/1
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.log"
}

PUT myindex2/_doc/2
{
  "log.file.path" : "/var/log/dev-collateral/uaa.2020-09-26.txt"
}

使用

regexp

搜索

GET myindex2/_search
{
  "query": {
    "regexp": {
      "log.file.path": "/var/log/dev-collateral/uaa.2020-09-26.*"
    }
  }
}

---

我使用了这个查询，它是有效的

{
  "query": {
    "regexp": {
      "log.file.path.keyword": {
        "value": "/var/log/dev-collateral/uaa.*",
        "flags": "ALL",
        "max_determinized_states": 10000,
        "rewrite": "constant_score"
      }
    }
  }
}