以下是eleasticsearch返回的json資料：
{ "took" : 12,"timed_out" : false,"_shards" : { "total" : 5,"successful" : 5,"failed" : 0},"hits" : { "total" : 8,"max_score" : 2.6739764,"hits" : [ { "_index" : "cef","_type" : "alert","_id" : "6","_score" : 2.6739764,"_source":{ "user": "dean","version": "0","device_vendor": "security","device_product": "threatmanager","device_version": "1.0","signature_id": "100","description": "worm successfully stopped","severity": "10","extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "5","_score" : 2.3862944,"_source":{ "user": "dean","version": "0","device_vendor": "security","device_product": "threatmanager","device_version": "1.0","signature_id": "100","description": "worm successfully stopped","severity": "10","extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext1": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "AUpMu6M4z71lXPfoDG1F","_score" : 2.098612,"_source":{"user":"dean","version":"0","device_vendor":"security","device_product":"threatmanager","device_version": "1.0","signature_id":"100","description":"worm successfully stopped","severity":"10","extension":"src=10.0.0.1 dst=2.1.2.2 spt=1333","ext4": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext6": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "AUpMxKDDz71lXPfoDG1G","_score" : 2.098612,"_source":{"user":"dean","version":"0","device_vendor":"security","device_product":"threatmanager","device_version": "1.0","signature_id":"100","description":"worm successfully stopped","severity":"10","extension":"src=10.0.0.1 dst=2.1.2.2 spt=1333","ext2": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "4","_score" : 2.098612,"_source":{ "user": "dean","version": "0","device_vendor": "security","device_product": "threatmanager","device_version": "1.0","signature_id": "100","description": "worm successfully stopped","severity": "10","extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext62": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "3","_score" : 2.098612,"_source":{ "user": "dean","version": "0","device_vendor": "security","device_product": "threatmanager","device_version": "1.0","signature_id": "100","description": "worm successfully stopped","severity": "10","extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext10": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "2","_score" : 1.5108256,"_source":{ "user": "dean","version": "0","device_vendor": "security","device_product": "threatmanager","device_version": "1.0","signature_id": "100","description": "worm successfully stopped","severity": "10","extension": "src=10.0.0.1 dst=2.1.2.2 spt=1232""ext7": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}}, { "_index" : "cef","_type" : "alert","_id" : "AUpMuF-Pz71lXPfoDG1E","_score" : 1.5108256,"_source":{"user":"dean","version":"0","device_vendor":"security","device_product":"threatmanager","device_version": "1.0","signature_id":"100","description":"worm successfully stopped","severity":"10","extension":"src=10.0.0.1 dst=2.1.2.2 spt=1232","ext19": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext41": "src=10.0.0.1 dst=2.1.2.2 spt=1232","ext9": "src=10.0.0.1 dst=2.1.2.2 spt=1232"}} ]}}各位可以看到，在Extension後方會有不定量的ext欄位（實際上開發時不只ext），有時有三個，有時有一個，甚至十個。目前我解析的方式是decoded = json_decode($json); //decode json$results = $decoded->hits->hits;foreach ($results as $item) { $id = $item->_id; //get the id$version = $item->_source->version; // get the version$user = $item->_source->user; // get the user$device_vendor = $item->_source->deviceVendor; // get the device_vendor$device_product = $item->_source->deviceProduct; // get the device_product$device_version = $item->_source->deviceVersion; // get the device_version$signature_id = $item->_source->signatureId; // get the signature_id$description = $item->_source->name; // get the description$severity = $item->_source->severity; // get the severity$extension = $item->_source->extension; // get the extension}這樣子的寫法可以清楚的去撈出我需求的資料，前提是我知道回傳的欄位是什麼。那像現在無法預測欄位的情形，只能去遍歷整個json，但我不知道該如何下手，希望各位先進指點一下。感謝！