弹性搜索脚本字段

Question

我正在尝试运行一个脚本字段查询。我已经将以下脚本放置在config/ script文件夹中

1+ my_var

rwxr-xr-x 3 elasticsearch elasticsearch 4096 Jan  4 16:08 ..
-rwxrwxrwx 1 root          root           145 Jan  7 11:57 session-duration-script.groovy
-rwx------ 1 root          root           124 Jan  7 12:52 calc-session-duration-script.groovy
-rwxrwxrwx 1 root          root            11 Jan  7 13:09 my_script.groovy
drwxr-xr-x 2 elasticsearch elasticsearch 4096 Jan  7 13:09 .

mgmt/cm/access/access-event-logs/session-summary/_search

{
    "script_fields": {
        "my_field": {
            "file": "my_script",
            "params": {
              "my_var": 2
            }
        }
    }

}

这是错误消息

Caused by: SearchParseException[failed to parse search source [{
   "script_fields": {
        "my_field": {
            "file": "my_script",
            "params": {
              "my_var": 2
            }
        }

   }
}]]; nested: SearchParseException[must specify a script in script fields];
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:848)
        at org.elasticsearch.search.SearchService.createContext(SearchService.java:651)
        at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:617)
        at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:368)
        at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:368)
        at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryTransportHandler.messageReceived(SearchServiceTransportAction.java:365)
        at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:350)
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)
Caused by: SearchParseException[must specify a script in script fields]
        at org.elasticsearch.search.fetch.script.ScriptFieldsParseElement.parse(ScriptFieldsParseElement.java:98)
        at org.elasticsearch.search.SearchService.parseSource(SearchService.java:831)
        ... 10 more

1. 我需要启用groovy脚本来运行script_field查询吗？从文档中我了解到ES会导致在/config/script下放置的执行脚本而不启用脚本

Answer 1

您只需要将脚本字段的定义包装在script部分中，如下所示：

  "script_fields": {
    "my_field": {
      "script": {                 <---- add this
        "file": "my_script",
        "params": {
          "my_var": 2
        }
      }
    }
  }

还要确保启用动态脚本从elasticsearch.yml配置文件中存储的脚本文件(+重新启动节点)：

script.file: on