ElasticSearch使用

摘录自官网

举一个栗子

现在我们需要对存在ES中的Log状态进行查询，那么重要的筛选条件就是Log的状态。已知Log状态字段为“level”，值有三种，分别是“INFO”,“DEBUG”，“WARN”，“ERROR”，索引名为Index_XXXX;

---

简单查询

现在我们要查询所有信息，那么查询如下

GET Index_*/_search
{
  "query": {
  	 "match_all": {}
   }
}

---

现我们需要查询到除开INFO以外的所有信息

GET Index_*/_search
{
  "query": {
    "bool": {
      "must_not": [ 
     	 {"match": { "level": "INFO"}}
       ]
    }
  }
}

---

老板说也不想要DEBUG了，有时候还只想查ERROR

GET Index_*/_search
{
  "query": {
    "bool": {
    	"must": [
        	{"match": {"level": "ERROR"}}
      	], 
	    "must_not": [
	        {"match": {"level": "INFO"}},
	        {"match": {"level": "DEBUG"}}
	    ]
    }
  }
}

---

排序

老板添加了时间字段"@timestamp"，想按时间倒序排列

GET Index_*/_search
{
  "query": {
    "bool": {
    	"must": [
        	{"match": {"level": "ERROR"}}
      	], 
	    "must_not": [
	        {"match": {"level": "INFO"}},
	        {"match": {"level": "DEBUG"}}
	    ]
    }
  },
  "sort": [
    {
      "@timestamp": { "order": "desc" }
    }
  ]
}

---

范围查询

现在添加时间范围

GET Index_*/_search
{
  "query": {
    "bool": {
    	"must": [
    		{"range": {
    			"@timestamp": {
    				"gte": "2019-04-23T04:11:41.813Z",
    				"lte": "2019-04-23T08:11:38.192Z"
    				//gte:>= gt:> lte:<= lt:<
    			}
    		}
    	},
        	{"match": {"level": "ERROR"}}
      	], 
	    "must_not": [
	        {"match": {"level": "INFO"}},
	        {"match": {"level": "DEBUG"}}
	    ]
    }
  },
  "sort": [
    {
      "@timestamp": { "order": "desc" }
    }
  ]
}

---

聚合查询

现在我们完成了上述所有查询，满足了一般需求，然而还不够，老板想要获取Log状态每个状态每一天的总量。
（Log状态按时间分组后按状态统计Count）

GET Index_*/_search
{
  "query": {
    "bool": {
      "must": [
        {"range": {"@timestamp": {"gte": "2019-04-23T04:11:41.813Z"}}}
      ],
      "must_not": [
        {"match": { "level": "INFO" }}
      ]
    }
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ],
  "aggs": {
    "countByTime": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "day",
        "format": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", 
        "order": {"_key": "desc"}
      },
      "aggs": {
        "countByLevle": {
          "terms": {
            "field": "level_value", 
            "order": {"_key": "asc"}
          }
        }
      }
    }
  }
}

---

未完待续