文章目录
一、es6.8版本后进行了比较大的改动，包括Api操作
1、pom依赖
<dependency>
<groupId>org.elasticsearch</groupId>
<artifactId>elasticsearch</artifactId>
<version>6.8.1</version>
</dependency>
es6.8以后，官方给出了两种请求api,一个是高级，一个是低级，官方建议换成高级，并且抛弃了以前的transportClient这个api，目前的高级只不过是对低级的封装。
<!-- 低级 -->
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>elasticsearch-rest-client</artifactId>
<version>6.8.1</version>
</dependency>
<!-- 高级 -->
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>elasticsearch-rest-high-level-client</artifactId>
<version>6.8.1</version>
</dependency>
2、连接池api
//高级
public RestHighLevelClient getEsHighInit() throws Exception {
RestClientBuilder http = RestClient.builder(new HttpHost("192.168.1.1", 111, "http"))
.setRequestConfigCallback(new RestClientBuilder.RequestConfigCallback() {
@Override
public RequestConfig.Builder customizeRequestConfig(RequestConfig.Builder requestConfigBuilder) {
requestConfigBuilder.setConnectTimeout(10000);
requestConfigBuilder.setSocketTimeout(10000);
requestConfigBuilder.setConnectionRequestTimeout(10000);
return requestConfigBuilder;
}
}).setMaxRetryTimeoutMillis(60 * 10000);
return new RestHighLevelClient(http);
}
//低级
public RestClientBuilder getEsLowInit() throws Exception {
RestClientBuilder http = RestClient.builder(new HttpHost("192.168.1.1", 111, "http"))
.setRequestConfigCallback(new RestClientBuilder.RequestConfigCallback() {
@Override
public RequestConfig.Builder customizeRequestConfig(RequestConfig.Builder requestConfigBuilder) {
requestConfigBuilder.setConnectTimeout(10000);
requestConfigBuilder.setSocketTimeout(10000);
requestConfigBuilder.setConnectionRequestTimeout(100000);
return requestConfigBuilder;
}
}).setMaxRetryTimeoutMillis(60 * 10000);
return http;
}
二、根据kibana语句的Java api查询
1、根据索引名查询数据,不含任何条件,默认返回十条
GET alert/_search
{
"query": {
"match_all": {}
}
}
======
@Test
public void test(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
SearchHits hits = search.getHits();
SearchHit[] hits1 = hits.getHits();
for (SearchHit documentFields : hits1) {
Map<String, Object> sourceAsMap = documentFields.getSourceAsMap();
System.out.println(sourceAsMap);
}
} catch (Exception e) {
e.printStackTrace();
}
}
2、根据时间和索引查询数据
GET alert/_search
{
"query": {
"bool": {
"filter": {
"range": {
"timefirst": {
"gte": 0,
"lte": 1610209248000
}
}
}
}
}
}
//借助QueryBuilders工具类查询，QueryBuilders可以构建查询条件
@Test
public void test(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder boolQuery =
QueryBuilders.boolQuery()
.filter(QueryBuilders.rangeQuery("timefirst")
.gte(0).lte(1610209248000L));
searchSourceBuilder.query(boolQuery);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
SearchHits hits = search.getHits();
SearchHit[] hits1 = hits.getHits();
for (SearchHit documentFields : hits1) {
Map<String, Object> sourceAsMap = documentFields.getSourceAsMap();
System.out.println(sourceAsMap);
}
} catch (Exception e) {
e.printStackTrace();
}
}
3、根据条件一定存在某个字段进行查询
GET alert/_search
{
"query": {
"bool": {
"must": [
{
"exists": {
"field": "level"
}
},
{
"exists":{
"field":"src"
}
}
]
}
}
}
@Test
public void test(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder boolQuery =
QueryBuilders.boolQuery()
.must(QueryBuilders.existsQuery("level")).must(QueryBuilders.existsQuery("src"));
searchSourceBuilder.query(boolQuery);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
SearchHits hits = search.getHits();
SearchHit[] hits1 = hits.getHits();
for (SearchHit documentFields : hits1) {
Map<String, Object> sourceAsMap = documentFields.getSourceAsMap();
System.out.println(sourceAsMap);
}
} catch (Exception e) {
e.printStackTrace();
}
}
4、根据索引和所在多个ip值进行查询数组查询
GET alert/_search
{
"query": {
"bool": {
"filter": {
"terms": {
"entityip": [
"10.67.9.1",
"172.17.0.1"
]
}
}
}
}
}
=============
@Test
public void test(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder boolQuery =
QueryBuilders.boolQuery()
.filter(QueryBuilders.termsQuery("entityip","10.67.9.1","172.17.0.1"));
searchSourceBuilder.query(boolQuery);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
SearchHits hits = search.getHits();
SearchHit[] hits1 = hits.getHits();
for (SearchHit documentFields : hits1) {
Map<String, Object> sourceAsMap = documentFields.getSourceAsMap();
System.out.println(sourceAsMap);
}
} catch (Exception e) {
e.printStackTrace();
}
}
5、根据索引和某个字段前缀值查询数据
GET alert/_search
{
"query": {
"bool": {
"should":[
//满足以下三个其中的任意一个都为攻击
{ "prefix": { "entitytype": "security"}
}
]
}
}
}
=======================================
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder boolQuery =
QueryBuilders.boolQuery()
.should(QueryBuilders.prefixQuery("entitytype","security"));
searchSourceBuilder.query(boolQuery);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
6、根据索引和某个字段的值查询
GET alert/_search
{
"query": {
"bool": {
"should": [
{ "match": { "entityname": "LanSecS" }
}
]
}
}
}
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
BoolQueryBuilder boolQuery =
QueryBuilders.boolQuery()
.should(QueryBuilders.matchQuery("entityname","LanSecS"));
searchSourceBuilder.query(boolQuery);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
7、根据索引和某个字段的值集合分组
//aggs分组聚合查询
GET alert/_search
{
"aggs": {
"my_aggs": {
"terms":{
//字段.keyword是将entityname这个字段转化为字符串
"field": "entityname.keyword"
}
}
},
"size": 1
}
@Test
public void test2(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
TermsAggregationBuilder entityname = AggregationBuilders.terms("my_aggs").field("entityname.keyword");
// .subAggregation();
searchSourceBuilder.aggregation(entityname);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
ParsedStringTerms gradeTerms = (ParsedStringTerms) search.getAggregations().getAsMap().get("my_aggs");
List<? extends Terms.Bucket> buckets = gradeTerms.getBuckets();
for (Terms.Bucket bucket : buckets) {
String keyAsString = bucket.getKeyAsString();
System.out.println(keyAsString);
long docCount = bucket.getDocCount();
System.out.println(docCount);
}
} catch (Exception e) {
e.printStackTrace();
}
}
结果,key为entityname的值，doc_count为这个值的数量，如同mysql分组,可以用来查询统计数据
8、根据索引和多个字段的值聚合分组
//用entityname和orgid进行多字段聚合
GET alert/_search
{
"aggs": {
"my_aggs": {
"terms":{
"field": "entityname.keyword"
},
"aggs": {
"my_aggs2": {
"terms": {
"field": "orgid.keyword"
}
}
}
}
},
"size": 1
}
=======================================
@Test
public void test2(){
EsTestApplicationTests esTestController = new EsTestApplicationTests();
RestHighLevelClient esHighInit = null;
try {
esHighInit = esTestController.getEsHighInit();
SearchRequest searchRequest = new SearchRequest("alert");
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
TermsAggregationBuilder entityname = AggregationBuilders.terms("my_aggs").field("entityname.keyword");
entityname.subAggregation(AggregationBuilders.terms("my_aggs2").field("orgid.keyword"));
// .subAggregation();
searchSourceBuilder.aggregation(entityname);
searchRequest.source(searchSourceBuilder);
SearchResponse search = esHighInit.search(searchRequest, RequestOptions.DEFAULT);
ParsedStringTerms gradeTerms = (ParsedStringTerms) search.getAggregations().getAsMap().get("my_aggs");
List<? extends Terms.Bucket> buckets = gradeTerms.getBuckets();
for (Terms.Bucket bucket : buckets) {
String keyAsString = bucket.getKeyAsString();
System.out.println(keyAsString);
long docCount = bucket.getDocCount();
System.out.println(docCount);
ParsedStringTerms gradeTerms2 = (ParsedStringTerms) bucket.getAggregations().getAsMap().get("my_aggs2");
List<? extends Terms.Bucket> buckets1 = gradeTerms2.getBuckets();
for (Terms.Bucket bucket1 : buckets1) {
String keyAsString2 = bucket1.getKeyAsString();
System.out.println(keyAsString2);
long docCount2 = bucket1.getDocCount();
System.out.println(docCount2);
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
返回结果
3225
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
