GET filebeat-*/_search
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "message:(\"Exception\")",
"fuzzy_max_expansions": 50
}
},
{
"range": {
"@timestamp": {
"gte": "now-2h",
"lte": "now",
"format": "epoch_millis"
}
}
}
]
}
}
}
GET filebeat-*/_search
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "message:(\"ArrayIndexOutOfBoundsException\")",
"fuzzy_max_expansions": 50
}
},
{
"range": {
"@timestamp": {
"gte": "now-2h",
"lte": "now",
"format": "epoch_millis"
}
}
}
]
}
}
}
有点奇怪,Exception有返回数据,ArrayIndexOutOfBoundsException 却没有。。。
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "message:(\"Exception\")",
"fuzzy_max_expansions": 50
}
},
{
"range": {
"@timestamp": {
"gte": "now-2h",
"lte": "now",
"format": "epoch_millis"
}
}
}
]
}
}
}
GET filebeat-*/_search
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "message:(\"ArrayIndexOutOfBoundsException\")",
"fuzzy_max_expansions": 50
}
},
{
"range": {
"@timestamp": {
"gte": "now-2h",
"lte": "now",
"format": "epoch_millis"
}
}
}
]
}
}
}
有点奇怪,Exception有返回数据,ArrayIndexOutOfBoundsException 却没有。。。
2 个回复
somnr
赞同来自:
tacsklet - 公司有用到es
赞同来自: