elasticsearch - ES插件查询

Question

我正在运行以下查询并出现错误:

查询:

POST /sbl_nmon2019.12.02/_search?size=0
{"query":{
  "bool":{
  "must" : [{
    "range":{"@timestamp":{"gte": "now-30m"}},
    "aggs":{"max_cpu" : {"field":"cpu_consumed"}},
    "match":{"Server" : "siebeldbnode01"} 
  }]
  }
}}

错误:

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[range] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 5,
        "col": 5
      }
    ],
    "type": "parsing_exception",
    "reason": "[range] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line": 5,
    "col": 5
  },
  "status": 400
}

目的是找到特定节点的最后30分钟内索引的最大数字字段。

SY

Answer 1

您的查询格式不正确，应该看起来像这样。

POST /sbl_nmon2019.12.02/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "now-30m"
            }
          }
        },
        {
          "match": {
            "Server": "siebeldbnode01"
          }
        }
      ]
    }
  },
  "aggs": {
    "max_cpu": {
      "max": {
        "field": "cpu_consumed"
      }
    }
  }
}