最近做的项目中使用到了Es,我选择了SpringBoot-data-elasticSearch来操作Es,SpringData的封装还是比较好用的,把用到的api贴上来。
单条件查询:
QueryBuilder queryBuilder = QueryBuilders.matchQuery("json_message.json.type","Click");
多条件查询:
BoolQueryBuilder boolQueryBuilder = QueryBuilders.boolQuery();
// //多条件设置
boolQueryBuilder.must(QueryBuilders.matchQuery("json_message.json.type","Click")); boolQueryBuilder.must(QueryBuilders.matchQuery("json_message.json.value",b.getKeyAsString()));
聚合操作:
(求sum) SumAggregationBuilder sumBuilder = AggregationBuilders.sum("sum_avg").field("age"); (求term) TermsAggregationBuilder tab = AggregationBuilders.terms("group_by_value").field("json_message.json.value");
多条件聚合:
TermsAggregationBuilder tab = AggregationBuilders .terms("group_by_value") .field("json_message.json.value") //在每个分组结果中取最近一次调用时间 (.subAggregation是子聚合方法) .subAggregation(AggregationBuilders.max("max_time").field("@timestamp"));
查询结果:
SearchQuery searchQuery1 = new NativeSearchQueryBuilder() //此处设置的withIndices(indexs) 是动态索引集合,可根据传入的时间自动获取时间范围内的索引,即时间范围内的数据 .withIndices(indexs) .withTypes("doc") .withQuery(queryBuilder1) .addAggregation(tab) .build(); eg:获取source中的数据 List<LogFormatEntity> lfes = elasticsearchTemplate.queryForList(searchQuery1,LogFormatEntity.class);
聚合分桶结果:
Aggregations aggregations = elasticsearchTemplate.query(searchQuery, response -> response.getAggregations()); Map<String, Aggregation> map=aggregations.asMap(); if (!map.isEmpty()){ for(String s:map.keySet()){ StringTerms a=(StringTerms) map.get(s); List<StringTerms.Bucket> listBucket =a .getBuckets(); for(Terms.Bucket b:listBucket){ //取该分组的最近一次调用时间 也就是最大时间 Aggregation aggregation = b.getAggregations().asList().get(0); String maxJsonStr = aggregation.toString(); JSONObject maxJson = JSON.parseObject(maxJsonStr); String maxValueStr = maxJson.getString("max_time"); JSONObject maxValueJson = JSON.parseObject(maxValueStr); //分组后的分组类型 String key = b.getKeyAsString(); //该分组中内容的数量 String value = String.valueOf(b.getDocCount()); //最大时间(该类型最近一次调用时间)long 类型时间戳 String maxValue = maxValueJson.getString("value"); } }