如何获取我的metricbeat文件的系统参数的值？

Question

我是ElasticStack的新手，并希望从我的.NET核心项目中的Metricbeat中获取系统参数（如Cpu / Memory / diskio等）的值。

我想创建一个类似于kibana仪表板的页面。因此，我需要通过查询/ API从metricbeat文件中获取它们。

我写了以下代码

            ConnectionSettings connectionSettings;
            ElasticClient elasticClient;
            StaticConnectionPool connectionPool;
            var nodes = new Uri[]
            {
                new Uri(_options.Value.ElasticSearchUrl),
            };
            connectionPool = new StaticConnectionPool(nodes);
            string indexName = "metricbeat*";
            connectionSettings = new ConnectionSettings(connectionPool).DefaultIndex(indexName);
            elasticClient = new ElasticClient(connectionSettings);


            var elasticResponse = await elasticClient.SearchAsync<object>(s => s.Size(1).
Query(q => q.Bool(b => b.Must(m => m.Range(r => r.Field("system.memory.actual.used.pct").GreaterThan(0).LessThan(1))))));

但是elasticResponse给了我完整的命中细节，如下所示

{
  "took" : 35,
  "timed_out" : false,
  "_shards" : {
    "total" : 15,
    "successful" : 15,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : [
      {
        "_index" : "metricbeat-7.4.2-2019.12.18",
        "_type" : "_doc",
        "_id" : "hIK-GG8BkfAhjYcrdBP2",
        "_score" : null,
        "_source" : {
          "@timestamp" : "2019-12-18T11:22:11.595Z",
          "host" : {
            "name" : "a8a441269011"
          },
          "agent" : {
            "id" : "7e4f3202-461e-4f8d-8144-d2db5556ca1b",
            "version" : "7.4.2",
            "type" : "metricbeat",
            "ephemeral_id" : "348fb071-e058-411c-b781-8dd2ec445286",
            "hostname" : "a8a441269011"
          },
          "event" : {
            "dataset" : "system.memory",
            "module" : "system",
            "duration" : 389771
          },
          "metricset" : {
            "name" : "memory",
            "period" : 5000
          },
          "service" : {
            "type" : "system"
          },
          "system" : {
            "memory" : {
              "total" : 33731682304,
              "used" : {
                "pct" : 0.762,
                "bytes" : 25702785024
              },
              "free" : 8028897280,
              "actual" : {
                "free" : 23516848128,
                "used" : {
                  "pct" : 0.3028,
                  "bytes" : 10214834176
                }
              },
              "swap" : {
                "total" : 1023406080,
                "used" : {
                  "pct" : 0.0064,
                  "bytes" : 6553600
                },
                "free" : 1016852480
              },
              "hugepages" : {
                "free" : 0,
                "reserved" : 0,
                "surplus" : 0,
                "default_size" : 2097152,
                "total" : 0,
                "used" : {
                  "bytes" : 0,
                  "pct" : 0
                }
              }
            }
          },
          "ecs" : {
            "version" : "1.1.0"
          }
        },
        "sort" : [
          1576668131595
        ]
      }
    ]
  }
}

但是我只想

              "actual" : {
                "free" : 23516848128,
                "used" : {
                  "pct" : 0.3028,
                  "bytes" : 10214834176
                }
              }

请帮助。

解决方案：

var elasticResponse = elasticClient.Search<object>(s => s
                .DocValueFields(dvf => dvf.Fields("system.memory.*", "system.cpu.*")) 
                .Size(2)
                 );

Answer 1

您可以使用source filtering告诉elasticsearch您感兴趣的字段。使用NEST，您的搜索请求将看起来像

var elasticResponse = await client.SearchAsync<object>(s => s
    .Source(sf => sf.Includes(i => i.Fields("system.memory.actual.*")))
    .Size(1)
    .Query(q => q.Bool(b => b.Must(m =>
        m.Range(r => r.Field("system.memory.actual.used.pct").GreaterThan(0).LessThan(1))))));

更新：

在您的情况下，您也可以使用docvalue_fields以平面结构形式返回字段列表。

var elasticResponse = await client.SearchAsync<object>(s => s
    .DocValueFields("system.memory.actual.*") 
    .Size(1)
    .Query(q => q.Bool(b => b.Must(m =>
        m.Range(r => r.Field("system.memory.actual.used.pct").GreaterThan(0).LessThan(1))))));

foreach (var fields in elasticResponse.Fields)
{
    foreach (var value in fields)
    {
        Console.WriteLine($"{value.Key}: {fields.Value<object>(value.Key)}");
    }
}

输出

system.memory.actual.free: 23516848128
system.memory.actual.used.bytes: 10214834176
system.memory.actual.used.pct: 0.302799999713898

希望有所帮助。