es的查询操作

查询所有：

GET /myindex/_search
{
  "query": {
    "match_all": {}
  }
}

查询执行字段

GET /myindex/_search
{
  "query": { "match_all": {} },
  "_source": ["name","ip","port"]
}

term查询，对字段和值的精确查询。terms同时查询多个值

GET myindex/_search
{
  "query": {
    "term": {
      "name": {
        "value": "王晓"
      }
    }
  }
}

小范围分页查询,深度分页用scroll

GET /myindex/_search
{
  "query": { "match_all": {} },
  "from": 1,
  "size": 100
}

统计查询

GET myindex/_count
{
  "query": {
    "term": {
      "name": {
        "value": "王晓"
      }
    }
  }
}

范围查询基于时间

GET myindex/_search
{
  "query": {
    "bool": {
      "must": [
        {"range": {
          "report_time": {
            "gte": "2020-05-07T09:39:12.000Z",
            "lte": "2020-05-07T10:00:00.000Z"
          }
        }},
        {
          "term": {
            "name": {
              "value": "王晓"
            }
          }
        }
      ]
    }
  }
}

wildcard模糊匹配

GET myindex/_search
{
  "query": {
    "wildcard": {
      "url":  "password=*"
    }
  }
}

bool查询

• must
  返回的文档必须满足must子句的条件，并且参与计算分值
• filter
  查询的内容必须出现在检索到的文档中。与must不同，filter中的查询条件不会参与评分。filter对查询的数据有缓存功能。filter效率会比must高一些，一般，除了需要计算相关度的查询，一般使用filter
• should
  返回的文档可能满足should子句的条件。在一个bool查询中，如果没有must或者filter，有一个或者多个should子句，那么只要满足一个就可以返回。minimum_should_match参数定义了至少满足几个子句。相当于or
• must_not
  多个查询条件的相反匹配，相当于 not
  上面的条件进行组合查询

GET myindex/_search
{
    "query":{
        "bool":{
            "must":{
                "term":{
                    "user":"王晓"
                }
            },
            "filter":{
                "term":{
                    "tag":"tech"
                }
            },
            "must_not":{
                "range":{
                    "age":{
                        "gte":10,
                        "lte":50
                    }
                }
            },
            "should":[
                {
                    "term":{
                        "tag":"wow"
                    }
                },
                {
                    "term":{
                        "tag":"elasticsearch"
                    }
                }
            ]
        }

聚合统计

GET myindex/_search
{                                                     
   "aggs": {                                                 
      "date": {                                              
        "date_histogram": {                                  
          "field" : "timestamp",                             
          "interval" : "month",                              
          "format" : "yyyy-MM-dd"                            
      },                                                     
      "aggs": {                                              
        "ip":{                                               
          "terms": {                                         
            "field": "port",                                 
            "size":0                                
          }                                                  
        ,                                                    
        "aggs": {                                            
          "port":{                                           
            "terms": {                                       
              "field": "ip",                                 
              "size":0                              
          }                                                  
        }                                                    
      }                                                      
      }                                                      
   }                                                         
}                                                            
}                                                            
}                                                            

根据查询条件做更新

POST myindex/_update_by_query
{
  "script":{
    "source": "ctx._source['avg']='45'"
  },
  "query": {
    "term": {
      "_id": {
        "value": "oydDjnEB09QSljz23URs"
      }
    }
  }

根据查询条件删除

POST myindex/_delete_by_query
{
  "script":{
    "source": "ctx._source['avg']='45'"
  },
  "query": {
    "term": {
      "_id": {
        "value": "oydDjnEB09QSljz23URs"
      }
    }
  }