elasticsearch查询之term,range,prefix

日志查询：

1、term：代表完全匹配，即不进行分词器分析，文档中必须包含整个搜索的词汇

2、range：主要是对字段进行过滤筛选，可以是数字和字符串类型

3、prefix：前缀匹配

{
    "query": {
        "filtered": {
            "query": {
                "bool": {
                    "must": [
                        {
                            "term": {
                                "client.raw": "117.136.25.232"
                            }
                        }, 
                        {
                            "term": {
                                "request.raw": "/appstore/push/list"
                            }
                        },
                        {
                            "prefix": {
                                "date.raw": "09/May/2016"
                            }
                        }
                    ]
                }
            },
            "filter": {
                "and": [
                    {
                        "range": {
                            "@timestamp": {
                                "gte": "2016-05-10T00:00:00.000Z", 
                                "lte": "2016-05-11T00:00:00.000Z"
                            }
                        }
                    }
                ]
            }
        }
    }
}

 

转载于:https://www.cnblogs.com/duanxuan/p/6531135.html