Kibana 5.x DevTool常用命令

1、match_all 查询

 

GET _search
{
  "query": {
    "match_all": {
      "boost" : 1.0
    }
  }
}

 

2、使用Elasticsearch的时间字段，按照小时进行聚合查询（该为hourOfDay也可以查询dayOfWeek）

 

 

其中orderTime为时间字段

 

POST my_index_name/my_type_name/_search
{
  "query" : {
    "bool" : {
      "must" : [
        {
          "range" : {
            "orderTime" : {
              "from" : "2017-10-01T00:00:00.000Z",
              "to" : "2017-10-31T23:59:59.999Z",
              "include_lower" : true,
              "include_upper" : true,
              "boost" : 1.0
            }
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggs": {
      "hour": {
          "terms": {
              "size": 24, 
              "script": {
                "lang": "painless",
                "source": "doc['orderTime'].date.hourOfDay"
              },
              "order" : { "_term" : "asc" }
          }
      }
  },
  "size": 0
}

结果如下：

 

{
  "took": 2040,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 13200437,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "hour": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "0",
          "doc_count": 647778
        },
        {
          "key": "1",
          "doc_count": 367104
        },
        {
          "key": "10",
          "doc_count": 465885
        },
        {
          "key": "11",
          "doc_count": 521330
        },
        {
          "key": "12",
          "doc_count": 657373
        },
        {
          "key": "13",
          "doc_count": 695066
        },
        {
          "key": "14",
          "doc_count": 655091
        },
        {
          "key": "15",
          "doc_count": 634047
        },
        {
          "key": "16",
          "doc_count": 645829
        },
        {
          "key": "17",
          "doc_count": 681893
        },
        {
          "key": "18",
          "doc_count": 726542
        },
        {
          "key": "19",
          "doc_count": 850149
        },
        {
          "key": "2",
          "doc_count": 209313
        },
        {
          "key": "20",
          "doc_count": 971456
        },
        {
          "key": "21",
          "doc_count": 1076897
        },
        {
          "key": "22",
          "doc_count": 1073018
        },
        {
          "key": "23",
          "doc_count": 907532
        },
        {
          "key": "3",
          "doc_count": 132610
        },
        {
          "key": "4",
          "doc_count": 84856
        },
        {
          "key": "5",
          "doc_count": 86609
        },
        {
          "key": "6",
          "doc_count": 148654
        },
        {
          "key": "7",
          "doc_count": 243315
        },
        {
          "key": "8",
          "doc_count": 323679
        },
        {
          "key": "9",
          "doc_count": 394411
        }
      ]
    }
  }
}

 

 

3、查询集群节点是否禁用内存交换（swapping）

 

 

 

 

GET _nodes?filter_path=**.mlockall

结果如下：

 

{
  "nodes": {
    "AQCgSBBGQHmHuSGuVRogVA": {
      "process": {
        "mlockall": true
      }
    },
    "srpVG_BSRYaVYRk1H_RPMw": {
      "process": {
        "mlockall": true
      }
    }
  }
}

 

4、查询集群节点的最大文件描述符

 

GET _nodes/stats/process?filter_path=**.max_file_descriptors

结果如下：

 

{
  "nodes": {
    "AQCgSBBGQHmHuSGuVRogVA": {
      "process": {
        "max_file_descriptors": 65536
      }
    },
    "srpVG_BSRYaVYRk1H_RPMw": {
      "process": {
        "max_file_descriptors": 65536
      }
    }
  }
}

 

 

 

5、打开（默认关闭）动态数字映射

 

 

 

 

PUT my_index_name
{
  "mappings": {
    "my_type": {
      "numeric_detection": true
    }
  }
}

 

6、集群分片情况查询

 

GET _cat/shards

结果大致如下：

 

 

geleevr                       2 p STARTED 19939152   4.2gb 192.168.10.20 node-1
geleevr                       2 r STARTED 19939152   4.2gb 192.168.10.21 node-2
geleevr                       1 p STARTED 19943629   4.5gb 192.168.10.20 node-1
geleevr                       1 r STARTED 19943628   4.5gb 192.168.10.21 node-2
geleevr                       4 p STARTED 19947209   4.4gb 192.168.10.20 node-1
geleevr                       4 r STARTED 19947209   4.4gb 192.168.10.21 node-2
geleevr                       3 p STARTED 19941227   4.4gb 192.168.10.20 node-1
geleevr                       3 r STARTED 19941227   4.4gb 192.168.10.21 node-2
geleevr                       0 p STARTED 19929450   4.4gb 192.168.10.20 node-1
geleevr                       0 r STARTED 19929450   4.4gb 192.168.10.21 node-2

 

7、update_by_query操作

 

修改_id为满足条件的数组（该query查询可以使用其他lucene语法），将type_text字段的值修改为ABCD

GET my_index_name/my_type_name/_update_by_query
{
   "query": {
        "bool": { 
            "filter": {
                "terms": {
                    "_id": ["AV-1CviL38rfcwO8CQmT","AV-1CviL38rfcwO8CQl_"]
                }
            }
        }
    },
    "script": {
        "inline":"ctx._source.type_text = 'ABCD'"
    }
}