如何在Kibana中为嵌套文件编写脚本字段(7.6)



我是Elasticsearch和Kibana的新手,我想写一个脚本字段来获得嵌套字段值。我尝试了以下操作,但没有成功。

doc['dadatas.data_name.keyword:pression'].value

我想获得每个文档(记录(的压力值。

输出应为12.56

我的文档是这样的。

提前感谢!!

{
"_index":"process_data",
"_type":"_doc",
"_id":"UzFHVDM1MTAxMTk5QSAyMDAyMDAwOTUzN19TVDNBMjBfU1QzQTIwMTAwXzIwMjAtMDItMThUMTk6NDc6MzM=",
"_version":1,
"_score":1,
"_source":{
"eid":"",
"line":"Line 1",
"equipment":"Equipment 1",
"ladderver":"",
"registrydate":"2020-02-18T19:47:33",
"registryutcdate":"2020-02-18T10:47:33",
"setupid":"",
"workid":"2345743",
"datas":[
{
"datas_id":"001",
"name":"cycletime",
"value":"13.9"
},
{
"datas_id":"002",
"name":"machinetime",
"value":"10.7"
},
{
"datas_id":"003",
"name":"pressure",
"value":"12.56"
}
]
}
}
{
"script_fields": {
"pressure": {
"script": {
"source": "for(item in params._source.datas){ if(item.name=='pressure')return item.value;} return '';"
}
}
}
}

脚本字段是动态计算的。所以更好的选择是从内部的中提取字段

查询:

{
"query": {
"nested": {
"path": "datas",
"query": {
"term": {
"datas.name.keyword": {
"value": "pressure"
}
}
},
"inner_hits": {}
}
}
}

结果:

"hits" : [
{
"_index" : "index5",
"_type" : "_doc",
"_id" : "kf6xw3EB8jeMa7x6RMwZ",
"_score" : 0.9808291,
"_source" : {
"eid" : "",
"line" : "Line 1",
"equipment" : "Equipment 1",
"ladderver" : "",
"registrydate" : "2020-02-18T19:47:33",
"registryutcdate" : "2020-02-18T10:47:33",
"setupid" : "",
"workid" : "2345743",
"datas" : [
{
"datas_id" : "001",
"name" : "cycletime",
"value" : "13.9"
},
{
"datas_id" : "002",
"name" : "machinetime",
"value" : "10.7"
},
{
"datas_id" : "003",
"name" : "pressure",
"value" : "12.56"
}
]
},
"inner_hits" : {
"datas" : {
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 0.9808291,
"hits" : [
{
"_index" : "index5",
"_type" : "_doc",
"_id" : "kf6xw3EB8jeMa7x6RMwZ",
"_nested" : {
"field" : "datas",
"offset" : 2
},
"_score" : 0.9808291,
"_source" : {
"datas_id" : "003",
"name" : "pressure",
"value" : "12.56"
}
}
]
}
}
}
}
]
}

编辑1:我的答案是针对开发工具中的查询对于索引模式脚本字段,您需要在下面添加

for(item in params._source.datas)
{
if(item.name=='pressure'){
return item.value;
}
}
return 0;

最新更新