Lucene 在kibana中的数组中搜索
我正在将日志推送到elasticsearch,它将典型的文档存储为-Lucene 在kibana中的数组中搜索,lucene,elasticsearch,kibana,Lucene,elasticsearch,Kibana,我正在将日志推送到elasticsearch,它将典型的文档存储为- { "_index": "logstash-2014.08.11", "_type": "machine", "_id": "2tSlN1P1QQuHUkmoJfkmnQ", "_score": null, "_source": { "category": "critical log with list", "app_name": "attachment", "stacktrace_
{
"_index": "logstash-2014.08.11",
"_type": "machine",
"_id": "2tSlN1P1QQuHUkmoJfkmnQ",
"_score": null,
"_source": {
"category": "critical log with list",
"app_name": "attachment",
"stacktrace_array": [
"this is the first line",
"this is the second line",
"this is the third line",
"this is the fourth line",
],
"@timestamp": "2014-08-11T13:30:51+00:00"
},
"sort": [
1407763851000,
1407763851000
]
}
Kibana使搜索子字符串变得非常容易。例如,在仪表板中搜索“critical”
将获取任何字符串映射值中带有critical
一词的所有日志
如何搜索类似于
“第二行”
的内容,它是嵌套在我的文档中的数组中的字符串?这将是一个简单的字段:
查询,如-
"query": {
"query_string": {
"query": "stacktrace_array:*second line*"
}
...
因此,用外行术语来说,对于Kibana dashboard,将您的搜索查询如下-
stacktrace_array:*second line*