Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用管道处理语言查询 Amazon OpenSearch Service 数据

管道处理语言 (PPL) 是一种查询语言，允许您使用管道 (|) 语法查询存储在 Amazon OpenSearch Service 中的数据。PPL 需要 OpenSearch 或 Elasticsearch 7.9 或更高版本。

PPL 语法由管道字符 (|) 分隔的命令组成，其中数据从左到右流经每个管道。例如，PPL 语法用于查找具有 HTTP 403 或 503 错误的主机数、将它们聚合到每个主机并按影响顺序对它们进行排序，如下所示：

source = dashboards_sample_data_logs | where response='403' or response='503' | stats count(request) as request_count by host, response | sort -request_count

要开始使用，请在 OpenSearch 控制面板中选择查询工作台，然后选择 PPL。使用 bulk 操作索引一些示例数据：

PUT accounts/_bulk?refresh
{"index":{"_id":"1"}}
{"account_number":1,"balance":39225,"firstname":"Amber","lastname":"Duke","age":32,"gender":"M","address":"880 Holmes Lane","employer":"Pyrami","email":"amberduke@pyrami.com","city":"Brogan","state":"IL"}
{"index":{"_id":"6"}}
{"account_number":6,"balance":5686,"firstname":"Hattie","lastname":"Bond","age":36,"gender":"M","address":"671 Bristol Street","employer":"Netagy","email":"hattiebond@netagy.com","city":"Dante","state":"TN"}
{"index":{"_id":"13"}}
{"account_number":13,"balance":32838,"firstname":"Nanette","lastname":"Bates","age":28,"gender":"F","address":"789 Mady Street","employer":"Quility","city":"Nogal","state":"VA"}
{"index":{"_id":"18"}}
{"account_number":18,"balance":4180,"firstname":"Dale","lastname":"Adams","age":33,"gender":"M","address":"467 Hutchinson Court","email":"daleadams@boink.com","city":"Orick","state":"MD"}

以下示例在 age 大于 18 的账户索引中返回文档的 firstname 和 lastname 字段：

search source=accounts | where age > 18 | fields firstname, lastname

您可以使用一组完整的只读命令，如 search、where、fields、rename、dedup、stats、sort、eval、head、top 和 rare。PPL 插件支持所有 SQL 函数，包括数学、三角函数、日期时间、字符串、聚合和高级运算符和表达式。要了解更多信息，请参阅 OpenSearch PPL reference manual（《OpenSearch PPL 参考手册》）。