maven repository:
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>elasticsearch-rest-high-level-client</artifactId>
</dependency>
// es 6.0以上支持RestHighLevelClient
RestHighLevelClient client = new RestHighLevelClient(RestClient.builder(new HttpHost(your_host, your_port, "http")));
SearchRequest searchRequest = new SearchRequest(your_es_index);
searchRequest.types(your_es_type);
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
//查询条件,可以参考官网手册
BoolQueryBuilder boolQuery = QueryBuilders.boolQuery();
boolQuery.must(QueryBuilders.wildcardQuery("host", "10.229.208.*"));
boolQuery.mustNot(QueryBuilders.matchQuery("message", "DISPLAY_CMDRECORD"));
boolQuery.mustNot(QueryBuilders.matchQuery("message", "SUPPRESS_LOG"));
boolQuery.filter(QueryBuilders.rangeQuery("@timestamp").gte(start).lte(end));
searchSourceBuilder.query(boolQuery);
String[] includeFields = new String[] {"message", "@timestamp"};
String[] excludeFields = new String[] {};
searchSourceBuilder.fetchSource(includeFields, excludeFields);
searchRequest.source(searchSourceBuilder);
try {
//查询结果
SearchResponse searchResponse = this.client.search(searchRequest, RequestOptions.DEFAULT);
SearchHits hits = searchResponse.getHits();
SearchHit[] searchHits = hits.getHits();
for(SearchHit hit : searchHits) {
System.out.println(hit.getSourceAsString());
}
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}