使用 Piped Processing Language 查詢 Amazon OpenSearch Service 資料 - Amazon OpenSearch Service

使用 Piped Processing Language 查詢 Amazon OpenSearch Service 資料

Piped Processing Language (PPL) 是一種查詢語言,可讓您使用 pipe (|) 語法來查詢存放在 Amazon OpenSearch Service 中的資料。

PPL 語法包含以管道字元 (|) 分隔的命令,資料在其中通過每個管道從左流到右。例如,用來尋找具有 HTTP 403 或 503 錯誤的主機數目、依據主機進行彙總並依影響順序對它們排序的 PPL 語法,如下所示:

source = dashboards_sample_data_logs | where response='403' or response='503' | stats count(request) as request_count by host, response | sort -request_count

PPL 需要 OpenSearch 或 Elasticsearch 7.9 或更高版本。如需詳細的步驟和命令說明,可參閱 OpenSearch 文件

若要開始使用,請在 OpenSearch Dashboards 中選擇 Query Workbench (查詢工作台),然後選取 PPL。使用 bulk 操作來索引一些範例資料:

PUT accounts/_bulk?refresh {"index":{"_id":"1"}} {"account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"} {"index":{"_id":"6"}} {"account_number":6,"balance":5686,"firstname":"Hattie","lastname":"Bond","age":36,"gender":"M","address":"671 Bristol Street","employer":"Netagy","email":"hattiebond@netagy.com","city":"Dante","state":"TN"} {"index":{"_id":"13"}} {"account_number":13,"balance":32838,"firstname":"Nanette","lastname":"Bates","age":28,"gender":"F","address":"789 Mady Street","employer":"Quility","city":"Nogal","state":"VA"} {"index":{"_id":"18"}} {"account_number":18,"balance":4180,"firstname":"Dale","lastname":"Adams","age":33,"gender":"M","address":"467 Hutchinson Court","email":"daleadams@boink.com","city":"Orick","state":"MD"}

下列範例會對 age 大於 18 的帳戶索引中的文件傳回 firstnamelastname 欄位:

search source=accounts | where age > 18 | fields firstname, lastname
回應範例
id firstname lastname
0 Amber Duke
1 Hattie Bond
2 Nanette Bates
3 Dale Adams

您可以使用一組完整的唯讀命令,如 searchwherefieldsrenamededupstatssortevalheadtop 以及 rare。如需每個命令的描述和範例,請參閱命令

PPL 外掛程式支援所有 SQL 函數,包括數學、三角函數、日期時間、字串、彙總以及進階運算子和表達式。如需進一步了解,請參閱函數