/search/events/
<table border cellspacing=0 cellpadding=10 >
all
和用户定义的日志分组名all
now
表示当前时间-1d
,-1m
-3d,now
*
|-$!|
分隔的field名和值。每个field的name和value之间用冒号分隔,value用双引号括起来;包括tag、 appname、 logtype也可通过此参数过滤:样例如logtype:"apache"|-$!|appache.status:"200"
desc
和asc
desc
0
开始的数字0
1
的数字20
</table>
http://yottaapi.test:7001/v0/search/events/?ak=e35b49c3ee6bf2cfaf1312518d1799a8&qt=1418718860789&sign=86f7523bf4e9ea2bc4653fd8803c201d
result
: 表示请求是否成功,为Boolean
。total
:事件总数,为Integer
。page
: 页码,为Integer
。size
: 每页的事件数,为Integer
。events
: event的详情的数组,为Object
的Array
。
raw_message
: 原始事件内容,为String
。timestamp
: 以毫秒计算的UNIX时间戳,为Integer
。appname
,hostname
,logtype
,tag
,apache
等都是字段名,并且诸如apache.ua
等字段名之间有从属关系,在结果中也将表现为嵌套关系。{
result: true,
total: 101,
page: 0,
size: 20,
events: [
{
"appname": "dev-access",
"timestamp": 1418704239000,
"hostname": "centos6-70-alltest",
"raw_message": "192.168.1.118 - - [16/Dec/2014:12:30:39 +0800] \"GET /api/v0/search/fields/?field=appname:&filters=&order=&page=1&query=*&size=50&sourcegroup=all&sourcegroupCn=%E6%89%80%E6%9C%89%E6%97%A5%E5%BF%97&time_range=-1d,now&type=fields HTTP/1.1\" 200 325 \"http://alltest.rizhiyi.com/search/?query=*&time_range=-1d%2Cnow&order=&size=20&page=1&sourcegroup=all&type=timeline&_t=1418704212442&title=%E6%96%B0%E6%A0%87%E7%AD%BE&index=2\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:34.0) Gecko/20100101 Firefox/34.0\"",
"logtype": "apache",
"apache": {
"status": [
200
],
"referer_domain": [
"alltest.rizhiyi.com"
],
"resp_len": [
325
],
"version": [
"1.1"
],
"referer": [
"http://alltest.rizhiyi.com/search/?query=*&time_range=-1d%2Cnow&order=&size=20&page=1&sourcegroup=all&type=timeline&_t=1418704212442&title=%E6%96%B0%E6%A0%87%E7%AD%BE&index=2"
],
"clientip": [
"192.168.1.118"
],
"request_path": [
"/api/v0/search/fields/"
],
"ua": {
"device": [
"Other"
],
"browser_v": [
"Firefox 34.0"
],
"os": [
"Mac OS X"
],
"os_v": [
"Mac OS X 10.9"
],
"browser": [
"Firefox"
]
},
"method": [
"GET"
],
"request_query": [
"field=appname:&filters=&order=&page=1&query=*&size=50&sourcegroup=all&sourcegroupCn=%E6%89%80%E6%9C%89%E6%97%A5%E5%BF%97&time_range=-1d,now&type=fields"
]
},
"tag": [
"devtest"
]
},
....
]
}