在多个索引中搜索失败

7nbnzgx9  于 2021-06-13  发布在  ElasticSearch
关注(0)|答案(1)|浏览(3335)

我有以下索引

➜ curl -s -X GET http://10.1.1.1:9200/_cat/indices\?v | grep "filebeat-new-7.2.0-2020.12"
green  open   filebeat-new-7.2.0-2020.12.06-000085          hklG4PmgQyOhE0DzNf56xg   1   1   83258752            0     80.1gb           40gb
green  open   filebeat-new-7.2.0-2020.12.03-000084          Cplx4reTTOCcVsLg699G6g   1   1   83616802            0     80.3gb         40.1gb
green  open   filebeat-new-7.2.0-2020.12.09-000086          iOuHk1AXQ7O9I5CV00g5PQ   1   1   71596966            0       69gb         34.4gb
green  open   filebeat-new-7.2.0-2020.12.01-000083          3n6kWj1uSvCdFy5XFx3Ljw   1   1   84130267            0     80.2gb           40gb

当我在多个索引上运行下面的搜索时,我总是得到相同的结果(点击)

➜ curl -s -X GET "http://172.28.162.21:9200/filebeat-new-7.2.0-2020.12.0*/_search?pretty" -H 'Content-Type: application/json' -d'
{
  "track_total_hits": true,
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "docker.cluster": {
              "query": "stage-cluster"
            }
          }
        },
        {
          "match_phrase": {
            "docker-name": {
              "query": "stage-app"
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2020-12-09T22:30:00.000Z",
              "lte": "2020-12-09T23:30:00.000Z"
            }
          }
        }
      ],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "query_string": {
                  "fields": [
                    "Response"
                  ],
                  "query": "*errorCode\\\"\\:\\4\\0\\0*"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}' | grep "_index"
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",
        "_index" : "filebeat-new-7.2.0-2020.12.09-000086",

我的问题是,我无法检索正确的结果,所以我需要确保我的搜索工作对每个索引。我已经通过kibana搜索(gui)确认,点击结果超过200000次。
谢谢您。

ztmd8pv5

ztmd8pv51#

track\u total\u hits默认为10k,如果结果大于此值,则响应将指示返回值为下限。
几个问题:
总共你点击了多少个指数?
你能提供答案吗?

相关问题