Kibana 使用嵌套从elasticsearch查询现有索引

我们使用kibana安装了elasticsearch，我想知道是否可以使用NEST编写一个查询来显示.Net程序的日志文件

我尝试创建一个简单的LogMessage POCO类来提取消息，但没有成功

[ElasticsearchType(IdProperty = "Id")]
public class LogMessage
{
    public Guid? Id { get; set; }

    public Source Source { get; set; }
}

public class Source
{
    public String Message { get; set; }
}

搜索代码非常简单

var local = new Uri("http://servername:9200");
var settings = new ConnectionSettings(local);
var elastic = new ElasticClient(settings);
var request = new SearchRequest
            {
                From = 0,
                Size = 10,
            };

var r = elastic.Search<LogMessage>(request);

---

源是响应中

\u source

属性中的所有内容

  "_source": {
    "@timestamp": "2016-08-31T18:19:26.9228089+10:00",
    "level": "Debug",
    "messageTemplate": "Simple message",
    "message": "Simple message",
    "fields": {
      "Session": "AP2016831/08/2016 6:10:19 PM",
      "TX": "TX123-001 None",
      "ExecutionTime": 523792,
      "MethodTime": 109,
      "TransactionId": "6058862c-3f45-4956-8992-eb34eba0fa9b",
      "Workorder": "WoAP70906YY0831031604526",
    },
    "renderings": {
      "0": [
        {
          "Format": "0.00",
          "Rendering": "0.00"
        }
      ]
    }
  },

因此，您的

LogMessage

类型应该具有每种类型的属性。看起来

字段

可以包含任意键？如果是这种情况，您可能希望将其映射为

字典

；如果不是这样，那么也将其映射为特定的POCO类型。在最简单的情况下，这样的映射将起作用

[ElasticsearchType(Name = "logevent")]
public class LogMessage
{
    [JsonProperty("@timestamp")]
    public DateTimeOffset Timestamp {get; set; }

    public string Level {get; set; }

    public string MessageTemplate {get; set; }

    public string Message {get; set; }

    public Dictionary<string, object> Fields {get; set; }

    public Dictionary<string, object[]> Renderings {get; set; }
}

[ElasticsearchType（Name=“logevent”）]
公共类日志消息
{
[JsonProperty（“@timestamp”）]
公共DateTimeOffset时间戳{get；set；}
公共字符串级别{get；set；}
公共字符串MessageTemplate{get；set；}
公共字符串消息{get；set；}
公共字典字段{get；set；}
公共字典呈现{get；set；}
}

我们可以通过以下方法测试它是否正常工作

void Main()
{
    var client = new ElasticClient();

    var json = @"{
    ""@timestamp"": ""2016-08-31T18:19:26.9228089+10:00"",
    ""level"": ""Debug"",
    ""messageTemplate"": ""Simple message"",
    ""message"": ""Simple message"",
    ""fields"": {
      ""Session"": ""AP2016831/08/2016 6:10:19 PM"",
      ""TX"": ""TX123-001 None"",
      ""ExecutionTime"": 523792,
      ""MethodTime"": 109,
      ""TransactionId"": ""6058862c-3f45-4956-8992-eb34eba0fa9b"",
      ""Workorder"": ""WoAP70906YY0831031604526"",
    },
    ""renderings"": {
        ""0"": [
          {
          ""Format"": ""0.00"",
          ""Rendering"": ""0.00""
        }
      ]
    }
  }";

  LogMessage log = null;

  using (var stream = new MemoryStream(Encoding.UTF8.GetBytes(json)))
    log = client.Serializer.Deserialize<LogMessage>(stream);

  // do something with log
}

void Main（）
{
var client=新的ElasticClient（）；
var json=@”{
“@timestamp”：“2016-08-31T18:19:26.9228089+10:00”，
“级别”：“调试”，
“”消息模板“”：“”简单消息“”，
“”消息“”：“”简单消息“”，
“字段”：{
“会话”：“AP2016831/08/2016下午6:10:19”，
“TX”：“TX123-001无”，
“执行时间”：523792，
“方法时间”：109，
“交易ID”：“6058862c-3f45-4956-8992-eb34eba0fa9b”，
“工单”：“WoAP70906YY0831031604526”，
},
“渲染”：{
""0"": [
{
“格式”：“0.00”，
“呈现”：“0.00”
}
]
}
}";
LogMessage log=null；
使用（var stream=newmemoryStream（Encoding.UTF8.GetBytes（json）））
log=client.Serializer.Deserialize（流）；
//用原木做些什么
}

void Main()
{
    var client = new ElasticClient();

    var json = @"{
    ""@timestamp"": ""2016-08-31T18:19:26.9228089+10:00"",
    ""level"": ""Debug"",
    ""messageTemplate"": ""Simple message"",
    ""message"": ""Simple message"",
    ""fields"": {
      ""Session"": ""AP2016831/08/2016 6:10:19 PM"",
      ""TX"": ""TX123-001 None"",
      ""ExecutionTime"": 523792,
      ""MethodTime"": 109,
      ""TransactionId"": ""6058862c-3f45-4956-8992-eb34eba0fa9b"",
      ""Workorder"": ""WoAP70906YY0831031604526"",
    },
    ""renderings"": {
        ""0"": [
          {
          ""Format"": ""0.00"",
          ""Rendering"": ""0.00""
        }
      ]
    }
  }";

  LogMessage log = null;

  using (var stream = new MemoryStream(Encoding.UTF8.GetBytes(json)))
    log = client.Serializer.Deserialize<LogMessage>(stream);

  // do something with log
}