PHP-Elasticsearch不会返回像Kibana这样的所有结果

Question

我们已经为我们的服务器日志配置了ELK。

我们想用PHP查询elasticsearch。以下是我们的代码：

//Change URL Accordingly 
$elasticServer = ["172.29.106.202:9200"]; //Server IP/Name 

//Create Elastic Search Object 
$client = Elasticsearch\ClientBuilder::create() 
     ->setHosts($elasticServer) 
     ->setRetries(0) 
     ->build(); 

$result = new stdClass(); 

$params = array(); 
$params['index'] = '*'; //search all index 
$params['type'] = 'Beta Logs from 51.66'; 
$params['body']['query']['match']['message'] = "Action:read_session"; 
$result->searches = $client->search($params); 

这将返回一组数据。但是，返回的数据与我从Kibana UI获得的数据不相似。

更新

下面是指数的我的服务器列表：

health status index       pri rep docs.count docs.deleted store.size pri.store.size 
yellow open localbeta-logstash-2016.07.24 5 1  57231   0  39.7mb   39.7mb 
yellow open localbeta-logstash-2016.07.25 5 1  126438   0  41.2mb   41.2mb 
yellow open localbeta-logstash-2016.07.26 5 1  109705   0  42.8mb   42.8mb 
yellow open localbeta-logstash-2016.07.27 5 1  153558   0  52.2mb   52.2mb 
yellow open .kibana       1 1   2   0  9.6kb   9.6kb 
yellow open localbeta-logstash-2016.07.28 5 1  124439   0  38.8mb   38.8mb 
yellow open localbeta-logstash-2016.07.29 5 1  136844   0  47.6mb   47.6mb 
yellow open localbeta-logstash-2016.07.19 5 1  11535   0  3.6mb   3.6mb 
yellow open localbeta-logstash-2016.07.30 5 1  2501   0  888kb   888kb 
yellow open localbeta-logstash-2016.07.31 5 1  63040   0  43.8mb   43.8mb 
yellow open localbeta-logstash-2016.07.20 5 1  85636   0  27mb   27mb 
yellow open localbeta-logstash-2016.07.21 5 1  108346   0  37.7mb   37.7mb 
yellow open local-logstash-2016.05.11  5 1  667319   0 212.3mb  212.3mb 
yellow open localbeta-logstash-2016.07.22 5 1  125687   0  44mb   44mb 
yellow open localbeta-logstash-2016.08.01 5 1  3245   0  2.2mb   2.2mb 
yellow open localbeta-logstash-2016.07.23 5 1  18437   0  5.5mb   5.5mb 

任何解释？或更改代码？

Answer 1

如果你希望你的查询的行为可以像Kibana，你需要使用一个query_string这样的查询：

$params = array(); 
$params['index'] = '*'; //search all index 
$params['type'] = 'Beta Logs from 51.66'; 
$params['body']['query']['query_string']['query'] = "Action:read_session"; 
$result->searches = $client->search($params);