从 Logstash 过滤 Elasticsearch 查询

Question

我想在 logstash 的 elasticsearch 输入中使用查询过滤这些参数>

**host.raw = host 1 OR host 2
&
code != "123"**

我该如何查询？一段时间以来我一直在尝试几件事但没有成功 ES版本为1.7.1

input{
elasticsearch {
        host=>
        query => '{ "query": .... }'

Answer 1

您可以试试这个查询：

{
  "query": {
    "bool": {
      "should": [
        {
          "term": {
            "host.raw": "host 1"
          }
        },
        {
          "term": {
            "host.raw": "host 2"
          }
        }
      ],
      "must_not": {
        "term": {
          "code": "123"
        }
      }
    }
  }
}

将上述查询设置到您的配置中会产生以下结果：

input{
   elasticsearch {
       host => "..."
       query => '{"query": {"bool":{"should":[{"term":{"host.raw":"host 1"}},{"term":{"host.raw":"host 2"}}], "must_not":{"term":{"code":"123"}}}}}'

从 Logstash 过滤 Elasticsearch 查询

Filter Queries For Elasticsearch from Logstash

elasticsearch

logstash

elastic-stack