ELK日志收集之ES的DSL查询语句

一、简介

在Elasticsearch中，我们可以使用Elasticsearch-DSL(Elasticsearch Domain Specific Language)来构建和执行复杂的搜索查询。官方Query DSL指导文档。

叶查询：在特定字段中寻找特定值,例如 match ,term 或 range。

复合查询：具有查询子句或逻辑方式组和查询如 bool dis_max 包含must should must_not子句。

#全量查询
#匹配查询
#范围查询
#多字段查询
#过滤查询
#高亮查询
#分页查询
#排序查询
#聚合查询 如计算价格的平均值 最大 最小 
#复合查询 bool查询 可以包含must should must_not子句

二、DSL查询用法举例

0、准备测试数据

创建索引添加映射关系

PUT http://192.168.77.176:9200/vegetables
#body内容  josn格式
{
  "mappings": {
    "properties": {
      "name": {
        "type": "text",
        "analyzer": "ik_smart"
      },
      "price": {
        "type": "float"
      },
      "weight": {
        "type": "float"
      },
      "origin": {
        "type": "text",
        "analyzer": "ik_smart"
      },
      "purchase_date": {
        "type": "date"
      },
      "description": {
        "type": "text",
        "analyzer": "ik_smart"
      }
    }
  }
}

批量写入数据

POST http://192.168.77.176:9200/vegetables/_bulk
#body内容  josn格式
{"index": {}}
{"name": "西红柿", "price": 3.5, "weight": 0.2, "origin": "山东", "purchase_date": "2023-01-01", "description": "新鲜西红柿，口感酸甜。"}
{"index": {}}
{"name": "黄瓜", "price": 2.0, "weight": 0.3, "origin": "河北", "purchase_date": "2023-01-02", "description": "新鲜黄瓜，脆嫩多汁。"}
{"index": {}}
{"name": "茄子", "price": 4.0, "weight": 0.4, "origin": "河南", "purchase_date": "2023-01-03", "description": "新鲜茄子，肉质细腻。"}
{"index": {}}
{"name": "土豆", "price": 1.5, "weight": 0.5, "origin": "内蒙古", "purchase_date": "2023-01-04", "description": "新鲜土豆，口感粉糯。"}
{"index": {}}
{"name": "胡萝卜", "price": 2.5, "weight": 0.25, "origin": "山西", "purchase_date": "2023-01-05", "description": "新鲜胡萝卜，色泽鲜艳。"}

1.匹配查询 match

#全量匹配查询
GET http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "match_all": {}
  }
}

#单个匹配查询
GET http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
    "query":{
        "match":{
            "name": "黄瓜"
        }
    }
}

2.精确匹配查询 term  官方指导文档

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "term": {
      "price": 4.0
    }
  }
}

3.范围查询 range

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "range": {
      "price": {
        "gte": 3,
        "lte": 4
      }
    }
  }
}

4.多字段匹配查询 multi_match

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "multi_match": {
      "query": "黄瓜",
      "fields": ["name", "description"]
    }
  }
}

5.过滤查询 filter

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "bool": {
      "must": [
        {
          "multi_match": {
            "query": "黄瓜",
            "fields": ["name", "description"]
          }
        }
      ],
      "filter": [
        {
          "term": {
            "price": 2.0
          }
        }
      ]
    }
  }
}

6.高亮查询 返回高亮结果

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "size": 0,
  "aggs": {
    "your_aggregation": {
      "terms": {
        "field": "your_field",
        "size": 10
      }
    }
  }
}

7.分页查询

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式 每页显示2条数据，从序号0开始，即查询第1页
{
  "from": 0,
  "size": 2,
  "query": {
    "match_all": {}
  }
}

#body内容  josn格式 每页显示3条数据，从序号9开始(前3页需要0-8)，即查询第4页
{
  "from": 9,
  "size": 3,
  "query": {
    "match_all": {}
  }
}

第一页数据是西红柿 黄瓜

8.排序查询

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "match_all": {}
  },
  "sort": [
    { "price": "asc" }
  ]
}

ase升序  desc降序  西红柿最便宜排在最前面

9.聚合查询

POST http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "size": 0,
  "aggs": {
    "your_aggregation": {
      "terms": {
        "field": "your_field",
        "size": 10
      }
    }
  }
}

10.复合查询 bool查询 包含must should must_not子句

复合查询例子，它要求：
文章的标题中必须包含"Elasticsearch"这个词。
文章的内容中必须包含"distributed search"这个词。
文章的发布日期必须在2024年内。
至少有一个特征，例如文章被标记为featured_article。
文章不能被标记为retired。

POSR http://192.168.77.176:9200/vegetables/_search
#body内容  josn格式
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "title": "Elasticsearch"
          }
        },
        {
          "match": {
            "content": "distributed search"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "date": {
              "gte": "2024-01-01",
              "lte": "2024-12-31"
            }
          }
        }
      ],
      "should": [
        {
          "match": {
            "featured_article": true
          }
        }
      ],
      "must_not": [
        {
          "match": {
            "retired": true
          }
        }
      ]
    }
  }
}