es通过searchafter可以查出最新的一条日志数据
{
"id":"bhteWYABwxk3OCzQWDko",
"rulesId":"96100000",
"timestamp":"2022-04-24 10:19:50",
"hostIP":"103.133.243.97",
"hostname":"andlink.komect.com",
"attackTag":"封禁地区",
"attackType":4,
"requestUri":"/espapi/cloud/json/devices/(null)",
"httpMethod":"PUT",
"attackField":"ip",
"attackContent":"ip : MM",
"attackAction":1,
"mode":2,
"ruleBased":0,
"sort":[
"1650795590885"
],
"isExceptionRule":null,
"session":"",
"level":"高",
"action":"拦截"
}
马上通过id，bhteWYABwxk3OCzQWDko去查为null，要过几秒再查才能查出来
这和索引的refresh间隔有关吧，近实时检索，实际写操作是可以强制refresh的，spring data是这样的