问题:
需要通过Kibana查询日志进行分析,这时项通过post调用Kibana的elasticsearch/_msearch?rest_total_hits_as_int=true&ignore_throttled=true发现报500
最终发现
body的多端json需要追加换行符
如下:
{"index":"202310","ignore_unavailable":true,"preference":1703223854212}\n' +
`{"timeout":"30000ms","version":true,"size":500,"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"aggs":{"2":{"date_histogram":{"field":"@timestamp","fixed_interval":"12h","time_zone":"Asia/Shanghai","min_doc_count":1}}},"stored_fields":["*"],"script_fields":{},"docvalue_fields":[{"field":"@timestamp","format":"date_time"}],"query":{"bool":{"must":[],"filter":[{"bool":{"filter":[{"multi_match":{"type":"phrase","query":"${id}","lenient":true}},{"multi_match":{"type":"phrase","query":"Response","lenient":true}}]}},{"range":{"@timestamp":{"format":"strict_date_optional_time","gte":"2023-10-01T00:00:00.000Z","lte":"2023-11-01T00:00:00.000Z"}}}],"should":[],"must_not":[]}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"fragment_size":2147483647}}\n
尤其是最后一个换行
另外,Request Header中
"content-type": "application/x-ndjson"、 "kbn-version": "" 也是必须的