view surrouding document 介绍
kibana 进行日志检索时，有个功能“view surrouding document“ ， 查看指定日志的前后日志，类似如我们查看日志是 grep -A -B
image
查看实现原理
对kibana的源码不熟悉，通过tcpdump查看
// 抓起对es的请求
sudo tcpdump -i lo0 -nn -A port 9200 >> /tmp/search.log
// 查看surrouding document对应的请求
{"index":["lo*"],"ignore_unavailable":true,"preference":1629426306757}
{"version":true,"size":5,"search_after":[1629427817846,9],"sort":[{"@timestamp":{"order":"asc","unmapped_type":"boolean"}},{"_doc":{"order":"desc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}
{"index":["lo*"],"ignore_unavailable":true,"preference":1629426306757}
{"version":true,"size":5,"search_after":[1629427817846,9],"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}},{"_doc":{"order":"asc","unmapped_type":"boolean"}}],"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}}],"filter":[],"should":[],"must_not":[]}}}
原来是通过search_after来实现。
但是通过timestamp来排序还是有缺陷
排序从5条改成6条时，发现多了一条，如下图
image.png
image.png
与我们的期待的 grep -A -B 还是有一定的差距
