Elasticsearch-query_string查询

肉夹馍yc

已于 2022-08-17 14:06:10 修改

阅读量408

点赞数

分类专栏： Elasticsearch 文章标签： elasticsearch 搜索引擎大数据

于 2022-06-09 16:44:36 首次发布

本文链接：https://blog.csdn.net/qq_40605018/article/details/125205792

版权

Elasticsearch 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

官方文档

地址（https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax）

任何时候还是官方文档看着最有用啊

Es结构

这是一条查询结果示例：

#! Deprecation: [types removal] Specifying types in search requests is deprecated.
{
  "took" : 911,
  "timed_out" : false,
  "_shards" : {
    "total" : 16,
    "successful" : 16,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 516,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [
      {
        "_index" : "log-2022.04",
        "_type" : "_doc",
        "_id" : "",
        "_score" : null,
        "_source" : {
          "time" : "2022-04-29T08:36:05.034Z",
          "param" : "",
          "status" : 200,
          "@version" : "1",
          "agent" : {
            "id" : "",
            "name" : "app",
          },
          "level" : "info",
          "appid" : "",
          "tags" : [
            "aa"
          ],
          "fields" : {
            "source" : "aa"
          },
       
        },
        "sort" : [
          1651221365034
        ]
      }
    ]
  }
}

各输出字段介绍

嵌套属性查询

只匹配嵌套属性中的一个属性

由前述可知：属性agent里仍有两个属性，现在要指定匹配agent.id,
使用以下格式：
agent.\id:(内容)


GET /prod_feifan_fwlog*/_doc/_search
{
    "query":{
        "query_string":{
            "query":"(time:[2022-03-31T00:00:00Z TO 2022-04-29T15:59:59Z]) AND  (agent.\\id:(\"2f0894c2-2fc4-4asndvksndk5cddf\")) AND ( adress:(\"login\" OR \"logout\"))"
        }
    },
    "from":0,
    "size":20,
    "sort":[
        {
            "time":"desc"
        }
    ],
    "highlight":{

    }
}