基巴纳。通过匹配来自另一个过滤的值来过滤记录答案

【问题标题】：Kibana. Filtering records by matching values from another filtering基巴纳。通过匹配来自另一个过滤的值来过滤记录
【发布时间】：2020-12-10 09:30:33
【问题描述】：

我在 kibana 中看到这样的消息持续 5 秒：

Date, Message, TraceId

Dec 10, 2020 @ 10:49:50.285 New request start http://somehost/path1   7ec708ab153e644f
Dec 10, 2020 @ 10:49:51.179 New request end http://somehost/path1     7ec708ab153e644f
Dec 10, 2020 @ 10:49:52.285 New request start http://somehost/path2   1e090982aeb026a3
Dec 10, 2020 @ 10:49:54.285 New request start http://somehost/path3   b880dfa9c4fd39ad
Dec 10, 2020 @ 10:49:53.179 New request end http://somehost/path3     b880dfa9c4fd39ad
Dec 10, 2020 @ 10:49:54.349 New request start http://somehost/path4   65184024b220dd0c

如何过滤记录以仅查看“新请求开始”行没有与“traceId”匹配的对应“新请求结束”行？

例如，对于上面的行，我想查看结果：

Dec 10, 2020 @ 10:49:52.285 New request start http://somehost/path2   1e090982aeb026a3
Dec 10, 2020 @ 10:49:54.349 New request start http://somehost/path4   65184024b220dd0c

【问题讨论】：

标签： elasticsearch kibana kql

【解决方案1】：

你可以

按 traceID 分组
只取一个按日期排序的结果，或者在“消息”字段中过滤 1 个带有“开始”的结果

这里有一些例子：

{
  "size": 0,
  "aggs": {
    "group_by_trace": {
      "terms": {
        "field": "TraceId.keyword",
        "size": 10,
        "min_doc_count": 2
      },
      "aggs": {
        "startt_request": {
        "top_hits": {
          "sort": [
            {
              "date": {
                "order": "asc"
              }
            }
          ],
          "_source": {
            "includes": [
              "date",
              "message",
              "TraceId"
            ]
          },
          "size": 1
        }
        }
      }
    }
  }
}

然后回应：

{
  "aggregations" : {
    "group_by_trace" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "7ec708ab153e644f",
          "doc_count" : 2,
          "startt_request" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "testlog",
                  "_type" : "_doc",
                  "_id" : "SOvlZXYBTUPHNNy0GTa-",
                  "_score" : null,
                  "_source" : {
                    "date" : "Dec 10, 2020 @ 10:49:50.285",
                    "TraceId" : "7ec708ab153e644f",
                    "message" : "New request start http://somehost/path1"
                  },
                  "sort" : [
                    "Dec 10, 2020 @ 10:49:50.285"
                  ]
                }
              ]
            }
          }
        },
        {
          "key" : "b880dfa9c4fd39ad",
          "doc_count" : 2,
          "startt_request" : {
            "hits" : {
              "total" : {
                "value" : 2,
                "relation" : "eq"
              },
              "max_score" : null,
              "hits" : [
                {
                  "_index" : "testlog",
                  "_type" : "_doc",
                  "_id" : "rqLlZXYBcOugy9Fj5LZp",
                  "_score" : null,
                  "_source" : {
                    "date" : "Dec 10, 2020 @ 10:49:54.285",
                    "TraceId" : "b880dfa9c4fd39ad",
                    "message" : "New request start http://somehost/path3"
                  },
                  "sort" : [
                    "Dec 10, 2020 @ 10:49:54.285"
                  ]
                }
              ]
            }
          }
        }
      ]
    }
  }
}

或者更好的是，您可以使用过滤器：

GET /_search?filter_path=aggregations.group_by_trace.buckets.start_messages.buckets.start.start_request.hits.hits
{
  "size": 0,
  "aggs": {
    "group_by_trace": {
      "terms": {
        "field": "TraceId.keyword",
        "size": 10,
        "min_doc_count": 2
      },
      "aggs": {
        "start_messages": {
          "filters": {
            "filters": {
              "start": {
                "match": {
                  "message": "start"
                }
              }
            }
          },
          "aggs": {
            "start_request": {
              "top_hits": {
                "_source": {
                  "includes": [
                    "date",
                    "message",
                    "TraceId"
                  ]
                },
                "size": 1
              }
            }
          }
        }
      }
    }
  }
}

然后回应：

{
  "aggregations" : {
    "group_by_trace" : {
      "buckets" : [
        {
          "start_messages" : {
            "buckets" : {
              "start" : {
                "start_request" : {
                  "hits" : {
                    "hits" : [
                      {
                        "_index" : "testlog",
                        "_type" : "_doc",
                        "_id" : "SOvlZXYBTUPHNNy0GTa-",
                        "_score" : 1.0,
                        "_source" : {
                          "date" : "Dec 10, 2020 @ 10:49:50.285",
                          "TraceId" : "7ec708ab153e644f",
                          "message" : "New request start http://somehost/path1"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        },
        {
          "start_messages" : {
            "buckets" : {
              "start" : {
                "start_request" : {
                  "hits" : {
                    "hits" : [
                      {
                        "_index" : "testlog",
                        "_type" : "_doc",
                        "_id" : "rqLlZXYBcOugy9Fj5LZp",
                        "_score" : 1.0,
                        "_source" : {
                          "date" : "Dec 10, 2020 @ 10:49:54.285",
                          "TraceId" : "b880dfa9c4fd39ad",
                          "message" : "New request start http://somehost/path3"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      ]
    }
  }
}

【讨论】：