检查数组是否在logstash中包含值

检查数组是否在logstash中包含值,logstash,Logstash,假设我创建了这样一个字段: "market": [ { "name": ["name1","name2","name3","name4","name5" ] }, {"place":["P1","P2","P3"]} ] "query": { "nested" : { "path" : "market", "query" : {

假设我创建了这样一个字段:

"market": [
            {
              "name":  ["name1","name2","name3","name4","name5" ]
            },
              {"place":["P1","P2","P3"]}
          ]
"query": {
    "nested" : {
        "path" : "market",
        "query" : {
            "bool" : {
                "filter" : 
                   {"query_string" : {
                       "query" : "market.name:(name3 OR name4)"

                }
           }               
         }
    }
}
}
现在,我想检查字段“name”是否包含值“name3”或“name4”

我试过这个过滤器

filter {
elasticsearch {
                hosts => "localhost:9200"
                index=>"admin"
                query => 'market.name:(name3 OR name4)'
                sort => "_id:asc"                       
                fields => {host_machine =>  'host_machine' }
            }
}
但是它什么都不做(没有崩溃,没有错误消息,只是什么都不做)


我做错了什么?

它工作正常。just market字段不应为嵌套类型。在这种情况下(如果是嵌套的),我们使用如下查询模板选项:

"market": [
            {
              "name":  ["name1","name2","name3","name4","name5" ]
            },
              {"place":["P1","P2","P3"]}
          ]
"query": {
    "nested" : {
        "path" : "market",
        "query" : {
            "bool" : {
                "filter" : 
                   {"query_string" : {
                       "query" : "market.name:(name3 OR name4)"

                }
           }               
         }
    }
}
}

它工作正常。just market字段不应为嵌套类型。在这种情况下(如果是嵌套的),我们使用如下查询模板选项:

"market": [
            {
              "name":  ["name1","name2","name3","name4","name5" ]
            },
              {"place":["P1","P2","P3"]}
          ]
"query": {
    "nested" : {
        "path" : "market",
        "query" : {
            "bool" : {
                "filter" : 
                   {"query_string" : {
                       "query" : "market.name:(name3 OR name4)"

                }
           }               
         }
    }
}
}