Elasticsearch 数据查询小记（Linux命令行）

Elasticsearch Rest 接口数据查询

curl -XGET localhost:9200/{index_name}/_search?pretty -d \
-- 精确匹配
'{
  "query": {
    "term": {"sip_nat": "20.88.144.80"}
  }
}'

-- 模糊匹配
'{
  "query": {
    "match": {"sip_nat": "20.88.144.80"}
  }
}'

-- 多条件 bool和filter组合
'{
  "query": {
    "bool": {
      "filter":[
        {"term": {"host_mac": "001b2126e1fa"}},
        {"term": {"kill_result": "查杀修复成功"}}
      ]
    }
  }
}'

-- create_time升序排序 并limit 2
{ "query": { "match_all": {} }, "sort": [ { "create_time": { "order": "asc" } } ], "size": 2 }