0

I'm using Spring data Elasticsearch to parse data in ELasticseach. I have already there an indexed element (elastalert) witch contains the alert_sent property. So what i want to do is returning all alerts that were sent to the admin. I tried defining a method in the Repository List<Alert> findByAlert_sentTrue() but it seems that the underscore is a problem (as mentioned in the documentation http://docs.spring.io/spring-data/elasticsearch/docs/current/reference/html/#repositories.query-methods.query-property-expressions).

Here' the mapping of the indexed element:

{
  "elastalert_status" : {
    "mappings" : {
      "elastalert" : {
        "properties" : {
          "@timestamp" : {
            "type" : "date",
            "format" : "dateOptionalTime"
          },
          "aggregate_id" : {
            "type" : "string",
            "index" : "not_analyzed"
          },
          "alert_exception" : {
            "type" : "string"
          },
          "alert_info" : {
            "properties" : {
              "recipients" : {
                "type" : "string"
              },
              "type" : {
                "type" : "string"
              }
            }
          },
          "alert_sent" : {
            "type" : "boolean"
          },
          "alert_time" : {
            "type" : "date",
            "format" : "dateOptionalTime"
          },
          "match_body" : {
            "type" : "object",
            "enabled" : false
          },
          "rule_name" : {
            "type" : "string",
            "index" : "not_analyzed"
          }
        }
      }
    }
  }
}

I created an entity to use that indexed element:

   @Document(indexName = "elastalert_status", type = "elastalert")
    public class Rule {
        @Id
        private String id;
        private String name;
        private String es_host;
        private String es_port;
        private String index;
        private String type;
        private String query;
        private String TimeStamp;
        private String email;
        private int runEvery;
        private String alertsent;
        private String alertTime;
        private String matchBody;
    ...
Getters and Setters
...

With Curl it would be 

curl -XPOST 'localhost:9200/elastalert_status/elastalert/_search?pretty' -d '
{
  "query": { "match": { "alert_sent": true } }
}'

So how can I get all those sent alerts using Spring Data Elasticsearch ? Thanks.

4

1 回答 1

0

我找到了一个解决方案，我首先创建了一个扩展 ElasticsearchRepository 的存储库并添加了我的个性化查询

public interface RuleRepository extends ElasticsearchRepository<Rule,String> {

    @Query("{\"bool\": {\"must\": {\"match\": {\"alert_sent\": true}}}}")
    List<Rule> findSentAlert();
}

要可视化这些警报，只需添加以下代码：

    List<Rule> rules = repository.findSentAlert();
    System.out.println("Rule list: " + rules);

我希望它可以帮助某人:)

于 2016-05-11T21:55:04.433 回答