elasticsearch结合kibana操作

首先创建mapping，mapping更像数据的初始结构，也可以不创建，不创建情况下插入数据会默认创建

PUT my_index{
    "settings": {
        "number_of_shards ": 5,
        "number_of_replicas": 1
    },
    "mappings": {
        "my_doc": {
            "properties": {
                "title": {
                    "type": "text",
                    "normalizer": "my_normalizer"
                },
                "name": {
                    "type": "text",
                    "analyzer": "standard",
                    "boost": 2
                },
                "age": {
                    "type": "integer"
                },
                "created": {
                    "type": "date",
                    "format": "strict_date_optional_time||epoch_millis"
                }
            }
        }
    }
}

跨字段查询 

{
 "query": { 
 "multi_match": { 
 "query": "Poland Street W1V",
  "type": "most_fields", "fields": 
  [ "street", "city", "country", "postcode" ]
   }
    }
    } 
    ============ 
    修改返回值最大值
PUT INDEX/_settings {
 index :{ 
 "max_result_window" : 2147483647
  } 
 } 
 查询es返回总数不受限制
GET 500event20200225/_search
{
  "track_total_hits": true,
  "query": {
    "match_all": {}
  }
  
}
GET ti_v0/_search { 
"query": {
 "multi_match": {
  "type": "best_fields", "query": "http://157.52.156.37/mi3307", "fields": [], "lenient": "true"
   }
    }
     }

//查询当前所有的数据库w
GET /_cat/indices?v

PUT /movie_index 添加索引

DELETE /movie_index //删除索引

5.2.7修改—某个字段
POST movie_index/movie/3/_update
{
  "doc": {
    "doubanScore":"7.0"
  }
}
删除一个document
DELETE movie_index/movie/3
搜索type全部数据
GET movie_index/movie/_search

按条件查询
GET movie_index/movie/_search 
{
"query":{
"match_all": {}
}
}

按分词查询
GET movie_index/movie/_search 
{
  "query":{
    "match": {"name":"red"}
  }
}

按分词子属性查询
GET movie_index/movie/_search 
{
  "query":{
    "match": {"actorList.name":"zhang"}
  }
}

按短语查询，不再利用分词技术，直接用短语在原始数据中匹配
GET movie_index/movie/_search 
{
    "query":{
      "match_phrase": {"name":"operation red"}
    }
}

校正匹配分词，当一个单词都无法准确匹配，es通过一种算法对非常接近的单词也给与一定的评分，能够查询出来，但是消耗更多的性能。
GET movie_index/movie/_search fuzzy查询
{
    "query":{
      "fuzzy": {"name":"rad"}
    }
}
过滤--查询后过滤
GET movie_index/movie/_search
{
    "query":{
      "match": {"name":"red"}
    },
    "post_filter":{
      "term": {
        "actorList.id": 3
      }
    }
}
过滤--查询前过滤（推荐使用）
GET movie_index/movie/_search
{
    "query":{
        "bool":{
          "filter":[ {"term": {  "actorList.id": "1"  }},
                     {"term": {  "actorList.id": "3"  }}
           ],
           "must":{"match":{"name":"red"}}
         }
    }
}
字段值排序
GET 100event20191011/_search
{
  "query": {
     "match_all": {}
  },
  "sort": [
    {
      "devid": {
        "order": "desc"
      }
    }
  ]
}
bool 过滤
bool 过滤可以用来合并多个过滤条件查询结果的布尔逻辑，它包含一下操作符：
must :: 多个查询条件的完全匹配,相当于 and。
must_not :: 多个查询条件的相反匹配，相当于 not。
should :: 至少有一个查询条件匹配, 相当于 or。
这些参数可以分别继承一个过滤条件或者一个过滤条件的数组：
{
    "bool": {
        "must":     { "term": { "folder": "inbox" }},
        "must_not": { "term": { "tag":    "spam"  }},
        "should": [
                    { "term": { "starred": true   }},
                    { "term": { "unread":  true   }}
        ]
    }
}
过滤--按范围过滤
GET movie_index/movie/_search
{
   "query": {
     "bool": {
       "filter": {
         "range": {
            "doubanScore": {"gte": 8}
         }
       }
     }
   }
}
关于范围操作符：
gt
大于
lt
小于
gte
大于等于
lte
小于等于

排序
GET movie_index/movie/_search
{
  "query":{
    "match": {"name":"red sea"}
  }
  , "sort": [
    {
      "doubanScore": {
        "order": "desc"
      }
    }
  ]
}
5.2.19 分页查询
GET movie_index/movie/_search
{
  "query": { "match_all": {} },
  "from": 1,
  "size": 1
}
5.2.20 指定查询的字段
GET movie_index/movie/_search
{
  "query": { "match_all": {} },
  "_source": ["name", "doubanScore"]
}
5.2.21 高亮
GET movie_index/movie/_search
{
    "query":{
      "match": {"name":"red sea"}
    },
    "highlight": {
      "fields": {"name":{} }
    }
    
}
5.2.22 聚合
取出每个演员共参演了多少部电影
GET movie_index/movie/_search
{
  "aggs": {
    "groupby_actor": {
      "terms": {
        "field": "actorList.name.keyword"  
      }
    }
  }
}
每个演员参演电影的平均分是多少，并按评分排序
GET movie_index/movie/_search
{
  "aggs": {
    "groupby_actor_id": {
      "terms": {
        "field": "actorList.name.keyword" ,
        "order": {
          "avg_score": "desc"
          }
      },
      "aggs": {
        "avg_score":{
          "avg": {
            "field": "doubanScore"
          }
        }
       }
    }
  }
}
模糊匹配
GET  100event20191011/_search
{ "query": {
   "prefix": {
     "cdevtype": {
       "value": "/security"
     }
   }
}
}

"bool":{"should":[
//模糊查询前缀是aaaa或bbbb和cccc的数据
{ "prefix": { "ceventcategory": "/aaaa"}
},
{ "prefix": { "ceventcategory": "/bbbb" }
},
{ "prefix": { "ceventcategory": "/cccc"}
}
]
}

举例：
一、查询在时间1561599449922和1561599449941之间的数据并且必须存在cdip和csip字段外加cdip中有121.78.74.78的ip，然后桶聚合lid,cdip和ieventpri的值，script这种方法效率不高，不走倒排索引，不建议使用
GET  /_search
 {
   "query": {
      "bool": {
        "filter": {
          "range": {
            "lreceipttime": { 
              "gte": 1561599449922,//开始时间
              "lte": 1561599449941//结束时间
            } 
          }
        }, 
         "must": [ 
           {
           "exists":{
              "field":"cdip"//必须有值目标ip
           }
         },
           {
           "exists":{
              "field":"csip"//必须有值
           }},
            {
              "bool":{
                "filter": {
                  "terms": {
                    "cdip": [
                      "121.78.74.78"
                    ]
                  }
                }
            }
            }
           ]
     }
   },
    "aggs":{ 
       "my_name": {
            "terms": {//目标ip  个数分组
             "script": "doc['lid'].values+'/'+doc['cdip'].values+'/'+doc['ieventpri'].values"
             , "size": 1000000   //默认返回条数
          } 
     }
    },
   "from": 1,
   "size": 100//5000条
 }
二、走索引的方式
1、单字段集合
 GET  /_search
 {
   "query": {
      "bool": {
        "filter": {
          "range": {
            "lreceipttime": { 
              "gte": 1561599449922,//开始时间
              "lte": 1561599449941//结束时间
            } 
          }
        }, 
         "must": [ 
           {
           "exists":{
              "field":"cdip"//必须有值目标ip
           }
         },
           {
           "exists":{
              "field":"csip"//必须有值
           }},
            {
              "bool":{
                "filter": {
                  "terms": {
                    "cdip": [
                      "121.78.74.78"
                    ]
                  }
                }
            }
            }
           ]
     }
   },
    "aggs":{ 
      "my_name":{
        "terms":{
            "field": "lid"
        }
      }
    },
   "from": 1,
   "size": 100//5000条
 }
2、多字段聚合
GET  /_search
 {
   "query": {
      "bool": {
        "filter": {
          "range": {
            "lreceipttime": { 
              "gte": 1561599449922,//开始时间
              "lte": 1561599449941//结束时间
            } 
          }
        }, 
         "must": [ 
           {
           "exists":{
              "field":"cdip"//必须有值目标ip
           }
         },
           {
           "exists":{
              "field":"csip"//必须有值
           }},
            {
              "bool":{
                "filter": {
                  "terms": {
                    "cdip": [
                      "121.78.74.78"
                    ]
                  }
                }
            }
            }
           ]
     }
   },
    "aggs":{ 
       "my_name": {
            "terms": {//目标ip  个数分组
             "field": "aaaaa",
             "size": 1000   //默认返回条数
          }
     },
     "my_name2": {
            "terms": {//目标ip  个数分组
             "field": "bbbbb",
             "size": 1000  //默认返回条数
          }
     },
     "my_name3": {
            "terms": {//目标ip  个数分组
             "field": "ccccc",
             "size": 1000   //默认返回条数
          }
     }
    },
   "from": 1,
   "size": 100//5000条
 }
 
3、第三种多字段聚合
GET  /_search
{
    "size":0,
    "aggs":{
        "lid_Agg":{
            "terms":{
                "field":"lid"
            },
            "aggs":{
                "lid_Agg":{
                    "terms":{
                        "field":"lid"
                    }
                }
            }
        }
    }
}