Hi Team,
I have logs, where when bank account is opened i am getting below messages.
for APAC -
bank account is opened in APAC
for EMEA -
bank account is opened in EMEA
Say for a day, if there was 4 accounts opened, I am able to run elk query and get the correct result, the elk result is correct as i can confirm that with application log.
The query is,
GET acct-*/_search
{
"track_total_hits": true,
"size": 0,
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"version": true,
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": false,
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"log.file.path.keyword": "app.log"
}
}
],
"minimum_should_match": 1
}
},
{
"bool": {
"should": [
{
"match_phrase": {
"message": "bank account is opened in APAC"
}
}
],
"minimum_should_match": 1
}
}
]
}
},
{
"range": {
"@timestamp": {
"gte": "now-24h",
"lte": "now",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
}
}
It gives results like,
{
"took" : 459,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 1,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 4,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
}
}
I need to calculate total accounts created for a day (APAC + EMEA),
When I am adding second match_phrase for EMEA, its giving below error,
"match_phrase": {
"message": "bank account is opened in EMEA"
}
Error -
{
"type" : "x_content_parse_exception",
"reason" : "[44:23] [bool] failed to parse field [should]"
}
"caused_by" : {
"type" : "json_parse_exception",
"reason" : "Duplicate field 'match_phrase'\n at [Source: (org.elasticsearch.common.io.stream.ByteBufferStreamInput); line: 45, column: 37]"
}
How can I
- add second
match_phrasein above same query - and then also do addition (+ operation) to get the total bank accounts in the above query?
Thanks,