-- coding:utf-8 --

from datetime import datetime
from elasticsearch import Elasticsearch
import time
import datetime
import sys
import json
import urllib
import urllib2
import re
import time
import math
import chardet

def obtain(number):
es = Elasticsearch(
[‘10.214.0.134‘, ‘10.214.0.133‘],
http_auth=(‘elastic‘, ‘elastic‘),

str_search= number + " AND " + "code"
res = es.search(index="logstash-*", body={
    "query": {
        "bool": {
            "must": [{"query_string": { "query": str_search }},
        {"match_phrase": { "fields.filename": {"query": "app-wanda-credit-ds.log"}}}                    
        ]
        }
    }
}
)
print ("Got %d Hits:" % res[‘hits‘][‘total‘])
for hit in res[‘hits‘][‘hits‘]:
 s = json.loads(hit["_source"]["logmessage"].split(‘ ‘)[2])
code_value = s["code"]
msg_value = s["msg"] 
print "code : %s , msg : %s"%(code_value,msg_value)
 

print s_zidian

key = s_zidian.iterkeys()

CODE = key.next()

MSG = key.next()

print CODE

print MSG

result = dict(zip(CODE,MSG))

print result

if name == ‘main‘:
number=sys.argv[1]
obtain(number)

elk接口抓取日誌信息樣例