专题-子项-6--ELK-ES-常用语句--聚合--OR-AND

逗号分隔多索引

POST http://localhost:9200/index1,index2,index3/_search

所有索引的_all关键字

POST http://localhost:9200/_all/_search

通配符(*，+， - )

POST http://localhost:9200/school*/_search

POST http://localhost:9200/school*,-schools_gov /_search    //-表示非，不能是schools_gov

条件过滤器

curl -XPOST "http://localhost:9200/_search" -d'
{
    "query": {
        "filtered": {
            "query": {
                "query_string": {
                    "query": "drama"
                }
            },
            "filter": {
                "term": { "year": 1962 }
            }
        }
    }
}'

--------------------聚合--------------------

分组，并做一些指标数据的统计分析，比如要计算一批文档中某个业务字段的总数，平均数，最大最小值等，都属于聚合的范畴

 

（1）首先按照country国家来进行分组
（2）然后在每个country分组内，再按照入职年限进行分组
（3）最后计算每个分组内的平均薪资

GET /company/employee/_search
{
  "size": 0,
  "aggs": {
    "group_by_country": {
      "terms": {
        "field": "country"
      },
      "aggs": {
        "group_by_join_date": {
          "date_histogram": {
            "field": "join_date",
            "interval": "year"
          },
          "aggs": {
            "avg_salary": {
              "avg": {
                "field": "salary"
              }
            }
          }
        }
      }
    }
  }
}

 

统计每个国家的喜欢每种爱好的员工有多少个

GET /company/rd_center/_search 
{
  "size": 0,
  "aggs": {
    "group_by_country": {
      "terms": {
        "field": "country.keyword"
      },
      "aggs": {
        "group_by_child_employee": {
          "children": {
            "type": "employee"
          },
          "aggs": {
            "group_by_hobby": {
              "terms": {
                "field": "hobby.keyword"
              }
            }
          }
        }
      }
    }
  }
}

 

//must的两个条件都必须满足
//should中的两个条件至少满足一个就可以,OR

GET gather-034-20171225/_search
{
  "query": {
    "bool": {
      "must": [//must的两个条件都必须满足
        
		{"range": {
          "recive_time": {
            "gte": "2017-12-25T01:00:00.000Z",
            "lte": "2017-12-25T02:10:00.000Z"
          }
        }},
		
        {
          "bool": {
            "should": [//should中的两个条件至少满足一个就可以,OR
              {"range": {
                "live_delay": {
                  "gte": 1500
                }
              }},
              {
                "range": {
                  "stream_break_count.keyword": {
                    "gte": 1
                  }
                }
              }
            ]
          }
        }
		
      ]
    }
  }
}