python查询elasticsearch 获取指定字段的值的list

from elasticsearch import Elasticsearch
from datetime import datetime, timedelta

# 1.connect to Elasticsearch------------------------------------------------------------------------------------------------------
# prod连接到 Elasticsearch
es_of_prod = Elasticsearch('http://host:port', http_auth=("username", "pwd"), verify_certs=False, timeout=60)

# 2.构建KQL-----------------------------------------------------------------------------------------------------------------------
# 查询index
index_of_query = "index-name"
# 获取当前时间并减去1小时
current_time = datetime.now()
previous_hour_time = current_time - timedelta(hours=1)
# 格式化为 "年-月-日 时"
previous_hour_time_formatted = previous_hour_time.strftime("%Y-%m-%d %H")
# 格式化为 "年-月-日 时:分"
previous_hourAndMin_time_formatted = previous_hour_time.strftime("%Y-%m-%d %H:%M")
# 构建 KQL 查询字符串
kql_query_xxx_prod = 'context:"*{query String}*" AND ext.time:"*'+previous_hour_time_formatted+'*"'
# 构建 KQL 查询字符串
kql_query_xxx_prod_hourAndMin = 'context:"*{query String}*" AND ext.time:"*'+previous_hourAndMin_time_formatted+'*"'
print(f"query condition: {kql_query_xxx_prod_hourAndMin}")

# 3.构建KQL JSON------------------------------------------------------------------------------------------------------
# 当天 0 点
zero_today = current_time.replace(hour=0, minute=0, second=0, microsecond=0)
# 当天 24 点（直接取次日 0 点）
midnight_24 = zero_today + timedelta(days=1)
#环境情况：sit env:es version7.5.1，prd env:es version7.15.1,下面query_json在sit环境可以使用，在prd环境不能使用
kql_query_xxx_json = {
    "query": {
        "bool": {
            "must": [
                        {
                            "query_string": {
                                "query":kql_query_xxx_prod_hourAndMin,
                                "default_field": "*"  # 搜索所有字段
                            }
                        },
                        {
                            "range": {
                                "@timestamp": {
                                    "gte": zero_today,  # 当天00:00:00
                                    "lt": midnight_24,   # 第二天00:00:00
                                    "time_zone": "+08:00"  # 指定时区（如北京时间）
                                }
                            }
                        }
                    ]
        }
    }
}
# 4.es执行查询获得hits count大小---------------------------------------------------------------------------------------------------
previous_hour_xxx_count = es_of_prod.count(
    index = index_of_query,
    body = kql_query_xxx_json
)
print(f"previous_hour_xxx_count: {previous_hour_xxx_count['count']}")

# 5.执行查询，获取某个字段的value的list----------------------------------------------------------------------------------------------
query_body = {
    "query_string": {
        "query": kql_query_xxx_prod_hourAndMin,
        "default_field": "*",
        "analyze_wildcard": True,
        "lenient": True
    }
}
#size=10000，如果不设置size，默认只返回前10条数据
try:
    response = es_of_prod.search(
        index = index_of_query,
        query = query_body,
        size=10000
    )
    total = response['hits']['total']['value']
    print(f"获取到total:{total}")
    traceids = [hit['_source']['ext.traceId'] for hit in response['hits']['hits']]
    print(f"获取到{len(traceids)}条traceid记录")
    #可以遍历traceids，做后续的业务处理
except Exception as e:
    print(f"查询异常: {str(e)}")
    traceids = []