GET /_template/modu-log?pretty
DELETE /_template/modu-log
PUT _template/modu-log
{
"index_patterns": ["modu_log-*", "logstash-*"],
"order" : 100,
"settings": {
"number_of_shards": 1
},
"mappings": {
"doc": {
"properties": {
"messages": {
"type": "text",
"index" : "true",
"analyzer": "ik_max_word",
"search_analyzer": "ik_smart"
}
}
}
}
}
POST _analyze
{
"analyzer":"ik_max_word",
"text": "安徽省长江流域"
}
GET modu_log-2020.04.15/_mapping
#ik_smart
GET _analyze?pretty
{
"analyzer": "ik_smart",
"text":"验证码"
}
PUT test/doc/1
{
"msg":"Eating an apple a day keeps doctor away"
}
# 查看存储时候如何分词
GET modu_log-2020.03.08/_analyze
{
"field": "msg",
"text": "安徽省长江流域"
}
GET test/_search
{
"query":{
"match":{
"msg":"eating"
}
}
}
GET /modu_log-2019.09.02/_search
{
"query": {
"match_all": {}
},
"sort": {
"@timestamp": "desc"
}
}
# 单条件查询
GET /modu_log-2020.03.06/_search
{
"size": 5000,
"query": {
"match": {
"messages": "查询库存参数"
}
}
}
# 单条件查询 短语查询
GET /modu_log-2020.04.15/_search
{
"size": 5000,
"query": {
"match": {
"messages": "查询未领取福利数量"
}
}
}
# 多条件查询
GET /modu_log-2019.09.02/_search
{
"size": 500,
"query": {
"bool": {
"must": [
{"match": {
"source": "/data/server-user/log/errorlog/channel.error.log"
}},
{"match": {
"messages": "企业用户母账号登录失败"
}}
]
}
}
}
# 同一字段多条件查询 and or
GET /modu_log-2019.09.02/_search
{
"size": 500,
"query": {
"query_string": {
"query":"('个人用户查询购物车') OR ('供应商3469登录成功')",
"fields":["messages"]
}
}
}
# 在多个字段上查询关键字
GET /modu_log-2019.09.02/_search
{
"query":{
"multi_match": {
"query":"2019-09-02",
"fields":["@timestamp","dhtimestamp"]
}
}
}
# 按时间搜索
GET /modu_log-2019.09.06/_search
{
"query": {
"range" : {
"dhtimestamp":
{
"gt": "2019-09-06 23:05:00",
"lt": "2019-09-06 23:55:00"
}
}
}
}
# 按时间查找，带查询条件
GET /modu_log-2019.09.02/_search
{
"size": 500,
"query": {
"bool": {
"must":[
{
"match": {
"messages": "dyson"
}
},
{
"range" : {
"dhtimestamp": {
"gt": "2019-09-03 16:40",
"lt": "2019-09-03 16:50"
}
}
}
]
}
}
}
GET md_commodity_spu/_search
{
"size": 500,
"query": {
"bool": {
"must": [
{"match": {
"production_countries": "韩国"
}},
{"match": {
"delete_state": 0
}}
]
}
}
}
GET md_commodity_spu/_search
{
"query": {
"bool": {
"must": [
{"range": {
"create_time": {
"gt": "2018-11-01T01:12:40",
"lt": "2019-11-01T01:12:40"
}
}
},
{"match": {
"production_countries": "韩国"
}},
{"match": {
"delete_state": 0
}}
]
}
}
}
GET md_commodity_spu/_search
{
"size": 500,
"query": {
"bool": {
"must": [
{"range": {
"create_time": {
"gt": "2020-04-07T01:12:40"
}
}
},
{"match": {
"delete_state": 0
}}
]
}
}
}
GET md_commodity_spu/_search
{
"query": {
"bool": {
"must": [
{"range": {
"create_time": {
"gt": "2020-04-17T00:00:00",
"lt":"2020-04-17T01:00:00"
}
}
},
{"term": {
"merchant_id": 3483
}},
{"term": {
"delete_state": 0
}}
]
}
}
}
GET md_commodity_spu/_search
{
"size": 500,
"query": {
"bool": {
"must": [
{"range": {
"create_time": {
"gt": "2019-01-01T00:00:00",
"lt":"2020-05-01T00:00:00"
}
}
},
{"term": {
"merchant_id": 3328
}},
{"term": {
"delete_state": 0
}}
]
}
}
}
#使用字符匹配查询相当于mysql的like "%831"
GET md_commodity_spu/_search
{
"query": {
"wildcard": {
"classify.keyword": "*831"
}
}
}
#使用terms相当于mysql的 in
GET md_commodity_sku/_search
{
"query": {
"terms": {
"id": ["2360158993818368","2382662766895872"]
}
}
}
# 聚合group by查询类似select count(service_id) from skywk-dev_service_instance_resp_time_hour-20200706 where service_id=204 grou by service_id
GET skywk-dev_service_instance_resp_time_hour-20200706/_search
{
"query": {
"term": {
"service_id": {
"value": 204
}
}
},
"aggs": {
"count_service_id": {
"terms": {
"field": "service_id",
"size": 10
}
}
}
}
# 按receive_time排序并设置展示条数size
GET engine_speed_index/_search
{
"query":{"match_all": {}
},
"size": 20,
"sort": [
{
"receive_time": {
"order": "desc"
}
}
]
}
GET opdata20200924/_search
{
"size": 0,
"query": {
"bool": {
"must": [
{
"bool": {
"must": [
{"term": {
"login_id": {
"value": "936020918"
}
}}
],
"should": [
{
"term": {
"machinetype_code": {
"value": "MT0000000481",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000464",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000466",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000483",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000482",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000480",
"boost": 1.0
}
}
},
{
"term": {
"machinetype_code": {
"value": "MT0000000479",
"boost": 1.0
}
}
}
],
"adjust_pure_negative": true,
"boost": 1.0
}
},
{
"range": {
"primary_pump1_pressure": {
"from": 34.3,
"to": null,
"include_lower": false,
"include_upper": true,
"boost": 1.0
}
}
}
],
"adjust_pure_negative": true,
"boost": 1.0
}
},
"aggregations": {
"loginId": {
"terms": {
"field": "login_id",
"size": 10000,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"_count": "desc"
},
{
"_key": "asc"
}
]
},
"aggregations": {
"pumpPressure": {
"sum": {
"script": {
"source": "doc['primary_pump1_pressure'].value - params.maxValue;",
"lang": "painless",
"params": {
"maxValue": 34.3
}
}
}
}
}
}
}
}
# 类似MySQL的select * from table where second_machinetype_code=‘MT0000000233’ and worktime_value>0 and score>=80 and score<=80 and (svrdealer_code in ("111557", "101624") or saledealer_code in ("111557", "101624")) order by worktime_value desc
{
"query": {
"bool": {"must": [
{"term": {
"second_machinetype_code": {
"value": "MT0000000233"
}
}},
{"range": {
"score": {
"gte": 80,
"lte": 80
}
}},
{"range": {
"worktime_value": {
"gt": 0
}
}}
],
"should": [
{"terms": {
"svrdealer_code": [
"111557",
"101624"
]
}},
{"terms": {
"saledealer_code": [
"111557",
"101624"
]
}}
],
"minimum_should_match": 1
}
},
"size": 20,
"sort": [
{
"worktime_value": {
"order": "desc"
}
}
]
}
