ES DSL常用查询

1 分组聚合查询
对应SQL语句：（此SQL仅仅进行表意，语法上可能不正确）

	select 
			distinct  dip as system_attacked,
			distinct  sip as source_count,
			...
			-- 在DSL中的“aggs“中还存在分组聚合，由于此部分在一个SQL中无法直接一起实现，此部分在DSL中进行标记
	from table_1 
		where timestamp > 1626851930 
			and timstamp <  1626938330
			and
			(
				(name="11" and devtype in ["a","b","c"]
				or 
				(name <> "11" and devtype in ["f","g","h"])
					)
				)

GET /index_name/_search
{
    "query": {
        "bool": {
            "must": [
                {
                    "range": {
                        "timestamp": {
                            "gte": 1626851930,
                            "lte": 1626938330
                        }
                    }
                },
                {