elasticsearch - 根据 “_source”字段中的键在ElasticSearch中搜索记录

Question

我在 Elasticsearch 中有以下格式的记录:

 {
      "_index" : "feb14",
      "_type" : "apache_access",
      "_id" : "1EONaxeVR1-drG0EeQv2QA",
      "_score" : 1.0,
      "_source":{"message":"8.8.8.8 - kurt [18/May/2011:01:48:10 -0700] \"GET /admin HTTP/1.1\" 301 566 \"-\" \"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3\"","@version":"1","@timestamp":"2011-05-18T08:48:10.000Z","host":"amith-Dell-System-XPS-L502X","path":"/home/amith/Desktop/logstash-1.4.2/accesslog3","type":"apache_access","clientip":"8.8.8.8","ident":"-","auth":"kurt","timestamp":"18/May/2011:01:48:10 -0700","verb":"GET","request":"/admin","httpversion":"1.1","response":"301","bytes":"566","referrer":"\"-\"","agent":"\"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3\""}
    }

我需要根据记录的“_source”部分中的字段过滤记录。有人可以告诉我该怎么做吗？

我已经研究了Elasticsearch中的搜索api和脚本，但是我无法将它们结合起来以获得结果。

Answer 1

您可以使用http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html

例如:您可以在“邮件”或“身份验证”字段中搜索“Mozilla”或“kurt”:

"query": {
    "query_string": {
        "fields": ["message", "auth"],
        "default_operator": "OR", // or AND
        "query": "Mozilla kurt"
    }
}