使用 Piped Processing Language 查詢 Amazon OpenSearch Service 資料

Piped Processing Language (PPL) 是一種查詢語言，可讓您使用 pipe (|) 語法來查詢存放在 Amazon OpenSearch Service 中的資料。

PPL 語法包含以管道字元 (|) 分隔的命令，資料在其中通過每個管道從左流到右。例如，用來尋找具有 HTTP 403 或 503 錯誤的主機數目、依據主機進行彙總並依影響順序對它們排序的 PPL 語法，如下所示：

source = dashboards_sample_data_logs | where response='403' or response='503' | stats count(request) as request_count by host, response | sort -request_count

PPL 需要 OpenSearch 或 Elasticsearch 7.9 或更高版本。如需詳細的步驟和命令描述，可參閱 OpenSearch PPL reference manual (OpenSearch PPL 參考手冊)。

若要開始使用，請在 OpenSearch Dashboards 中選擇 Query Workbench (查詢工作台)，然後選取 PPL。使用 bulk 操作來索引一些範例資料：

PUT accounts/_bulk?refresh
{"index":{"_id":"1"}}
{"account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"[e-mail]","city":"Brogan","state":"IL"}
{"index":{"_id":"6"}}
{"account_number":6,"balance":5686,"firstname":"Hattie","lastname":"Bond","age":36,"gender":"M","address":"671 Bristol Street","employer":"Netagy","email":"[e-mail]","city":"Dante","state":"TN"}
{"index":{"_id":"13"}}
{"account_number":13,"balance":32838,"firstname":"Nanette","lastname":"Bates","age":28,"gender":"F","address":"789 Mady Street","employer":"Quility","city":"Nogal","state":"VA"}
{"index":{"_id":"18"}}
{"account_number":18,"balance":4180,"firstname":"Dale","lastname":"Adams","age":33,"gender":"M","address":"467 Hutchinson Court","email":"[e-mail]","city":"Orick","state":"MD"}

下列範例會對 age 大於 18 的帳戶索引中的文件傳回 firstname 和 lastname 欄位：

search source=accounts | where age > 18 | fields firstname, lastname

回應範例
id	firstname	lastname
0	Amber	Duke
1	Hattie	Bond
2	Nanette	Bates
3	Dale	Adams

您可以使用一組完整的唯讀命令，如 search、where、fields、rename、dedup、stats、sort、eval、head、top 以及 rare。如需每個命令的描述和範例，請參閱 OpenSearch PPL reference manual (OpenSearch PPL 參考手冊)。

PPL 外掛程式支援所有 SQL 函數，包括數學、三角函數、日期時間、字串、彙總以及進階運算子和表達式。如需進一步了解，請參閱 OpenSearch PPL reference manual (OpenSearch PPL 參考手冊)。