Create C# Class from existing Index

[Michal_Svacina (Michal Svačina)]

Hello,

I am pretty new to working with Elasticsearch. Right now I am trying to query some data from Elastic 6.5 with .net client NEST.

So I have existing index that I want to search In. I tried to create the C# class myself or with auto-generator QuickType.

Unfortunatelly with both approaches I can have something come back from Elastic but it never gets mapped on the properties it should.

I can get back 10 hits but most of the parameters are null except Counts and ID which match to the document ID in elastic.

So from that I know my configuration and connection works fine. But i think that the problem is with my class that is most likely bad.

When i open the JSON of document in Kibana it looks like this (some of the data is deleted):

{
  "_index": "",
  "_type": "_doc",
  "_id": "B1wPn3ABHLnBb2g1j46j",
  "_version": 1,
  "_score": null,
  "_source": {
    "some_identifier": "[ner#3-44-C-1]                         ",
    "severity": "",
    "matching_rule": "",
    "escalation_type": "INCIDENT",
    "contractId": "null",
    "sid": "",
    "@timestamp": "2020-03-03T06:22:41.980Z",
    "escalation_time": "07:22:41.100",
    "@version": "1",
    "message": "",
    "parameters": "",
    "userId": "null",
    "host": "",
    "path": "/srv/log/"
  },
  "fields": {
    "@timestamp": [
      "2020-03-03T06:22:41.980Z"
    ]
  },
  "sort": [
    1583216561980
  ]
}

How should I create the class so it works?

[forloop (Russ Cam)]

You only need to create a class for the _source, something like the following should work

public class MyDocument
{
    [PropertyName("some_identifier")]
    public string SomeIdentifier { get; set; }

    [PropertyName("severity")]
    public string Severity { get; set; }

    [PropertyName("matching_rule")]
    public string MatchingRule { get; set; }

    [PropertyName("escalation_type")]
    public string EscalationType { get; set; }

    [PropertyName("contractId")]
    public string ContractId { get; set; }

    [PropertyName("sid")]
    public string Sid { get; set; }

    [PropertyName("@timestamp")]
    public DateTimeOffset Timestamp { get; set; }

    [PropertyName("escalation_time")]
    public DateTimeOffset EscalationTime { get; set; }

    [PropertyName("@version")]
    public string Version { get; set; }

    [PropertyName("message")]
    public string Message { get; set; }

    [PropertyName("parameters")]
    public string Parameters { get; set; }

    [PropertyName("userId")]
    public string UserId { get; set; }

    [PropertyName("host")]
    public string Host { get; set; }

    [PropertyName("path")]
    public string Path { get; set; }
}

[Michal_Svacina (Michal Svačina)]

Thank you so much.

I feel a bit stupid I did not try that.

[forloop (Russ Cam)]

No worries, hope it helps!