我正在使用Head插件来运行ELASTICSEARCH查询。
我想将查询结果转换为一个表格。
我只需要"hits"对象数组的部分,其中列是我在查询中指定的字段:"http.date","src_shift","@timestamp"和"src_tz"。
是否有任何工具或插件可以做到这一点?
以下是查询的简要输出:
"took": 2418,
"timed_out": false,
"_shards": {
"total": 3503,
"successful": 3503,
"failed": 0
},
"hits": {
"total": 2524,"max_score": 9.194927,"hits": [
{
"_index": "$002555","_type": "pcap","_id": "AVAJJphp2MeWtoWCbQYG","_score": 9.194927,"fields": {
"src_shift": [
1],"http.date": [
"Fri, 12 Jun 2015 22:40:54 GMT"],"@timestamp": [
1434147980397],"src_tz": [
"Europe/Warsaw"]}},{
"_index": "$002555","_type": "pcap","_id": "AVAJJphp2MeWtoWCbQYH","_score": 9.194927,"fields": {
"src_shift": [
1],"http.date": [
"Fri, 12 Jun 2015 22:40:54 GMT"],"@timestamp": [
1434147980397],"src_tz": [
"Europe/Warsaw"]}},...
root.aggregations
而不是root.hits.hits
。如果需要,随时可以创建另一个具有特定用例的问题。 - Val