Kibana常用操作总结

#查看es有多少索引
GET /_cat/indices?v

#查看数据结构
GET /indexName/

#最简单的查询数据
GET /indexName/_search
{
  
  "query": {"match_all": {}
    
  },
  "size": 100
}

#按条件查询数据
GET /indexName/_search
{
  "query": {
    "term": {
      "dataType": {
        "value": "6"
      }
    }
  }
}



#条件删除文档
delete lib/user/_query
{
  "query": {
    "match": { "first_name": "zhou"}
  }
}

#条件删除数据
post indexname/delete_by_query
{
	query: {
		#常规的查询条件
	}
}

#查看索引数据结构
put /indexname

#删除索引
delete /indexname

#删除所有索引
delete /*   

#查看索引信息
GET /_cat/indices?v   

#通过id搜索，最简单的搜索
GET indexName/_doc/id    

#最简单的删除
DELETE indexName/_doc/id   

#多字段排序
GET indexName/_search      
{
  "query": {
    "match_all": {
      
    }
  },
  "sort": [
    {
      "appkey": {
        "order": "desc"
      }
    },
    {
      "time":{
        "order": "desc"
      }
    }
  ]
}


#指定返回否些字段
GET indexName/_search        
{
  "query": {
    "match_all": {}
  },
  "_source": [
      "appkey","time"
    ]
}

#范围查询：es存储的时间字段最好是用时间戳
GET indexName/_search       
{
  "query": {
    "range": {
      "time": {
        "gte": 1617576410520,
        "lte": 1900000000000
      }
    }
  }
}


#前缀查询
GET indexName/_search       
{
  "query": {
    "prefix": {
      "system": {
        "value": "A"
      }
    }
  }
}

#通配符查询
GET indexName/_search     
{
  "query": {
    "wildcard": {
      "system": {
        "value": "*d*"
      }
    }
  }
}


#模糊查询，只能模糊0-2 没什么用
GET indexName/_search       
{
  "query": {
    "fuzzy": {
      "system": "Androi"
    }
  }
}

#多条件查询(根据业务修改内容)
GET indexName/_search       
{
  "query": {
    "bool": {
      "must": [
        {"terms": {
          "system": [
            "Android",
            "IOS"
          ]
        }}
      ],
      "must_not": [
        {
          "term": {
            "appkey": {
              "value": "10381819"
            }
          }
        }
      ]
    }
  }
}


#一个内容匹配多个字段
GET indexName/_search            
{
  "query": {
    "multi_match": {
      "query": "26429416",
      "fields": ["appkey","system"]
    }
  }
}

#加过滤条件查询(两条件查询)
GET indexName/_search      
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "appkey": {
              "value": "63883539"
            }
          }
          
        }
      ],
      "filter": {
        "term": {
          "appname": "钉钉"
        }
      }
    }
  }
}


#根据条件删除
POST /indexName/_delete_by_query?pretty
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "result_status": {
              "value": "0"
            }
          }
        }
      ]
    }
  },
  "sort": [
    {
      "detection_time_stmp": {
        "order": "desc"
      }
    }
  ]
}

#复制数据：
 

#复制数据：
POST _reindex
{
  "source": {
    "index": "client_analysis_data_bak"
  },
  "dest": {
    "index": "client_analysis_data"
  }
  
}