dsl组合查询
bool复合查询:filter 和must_not经常搭配一起使用 。
filter和must_not里面可以使用一些常用字段,比如match,term,terms,query_string等等,时间用range。
聚合aggs是和filter,must_not是同级,聚合可以使用term聚合单个字段,或者用script聚合多个字段(注意字段类型必须是keyword或者字段必须是字段整体),也可以写多个聚合aggs,也可以写嵌套的aggs
filter,must_not和他写法一致,如果要联合使用,是同级都在bool下面
GET /test/_search
{
"query": {
"bool": {
"filter": [
{
"match": {
"k": "v"//模糊查询k字段里面包含v值的内容
}
},
{
"term": {
"k": "v"//精确查询k字段等于v值的内容
}
},
{
"terms": {
"k": [
"v1","v2"//精确查询k字段等于v1值或者v2值的内容
]
}
},
{
"query_string": {
"query": "(k:v)"//模糊查询k字段里面包含v值的内容(和match一样)
}
},
{
"query_string": {
"query": "(k.keyword:v)"//精确查询k字段等于v值的内容(和term一样)
}
},
{
"query_string": {
"query": "(k:v AND/OR k1:v1)"//模糊查询k字段里面包含v值的内容 并且/或着 k1字段里面包含v1值的内容
}
},
{
"query_string": {
"query": "(k.keyword:v AND/OR k1.keyword:v1)"//精确查询k字段里面包含v值的内容 并且/或着 k1字段里面包含v1值的内容
}
}
]
}
}
}
range 两种办法
GET /test/_search
{
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-5d",
"to": "now"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-5d",
"lte": "now"
}
}
}
]
}
}
}
aggs聚合:例如聚合k和k1的字段内容分别出现了多少次,一共有两种写法
//field只能根据单字段聚合
GET /test/_search
{
"aggs": {
"a": {
"terms": {
"size": 1000,
"field": "k.keyword",
"min_doc_count": 1
}
},
"a1": {
"terms": {
"size": 1000,
"field": "k1.keyword",
"min_doc_count": 1
}
}
}
}
//script可以根据单字段聚合,也可以根据多个字段聚合,注意聚合的多个字段当中任何一个字段都不能为空,可以写if语句判断
GET /test/_search
{
"aggs": {
"a": {
"terms": {
"size": 1000,
"script": {
"source": """doc['k.keyword'].value"""
},
"min_doc_count": 1
}
},
"a1": {
"terms": {
"size": 1000,
"script": {
"source": """doc['k1.keyword'].value"""
},
"min_doc_count": 1
}
}
}
}
结果如下:
{
"took" : 145,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 1,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"a" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "kv",
"doc_count" : 7
},
{
"key" : "kv1",
"doc_count" : 3
}
]
},
"a1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "k1v",
"doc_count" : 5
},
{
"key" : "k1v1",
"doc_count" : 3
},
{
"key" : "k1v2",
"doc_count" : 2
}
]
}
}
}
aggs聚合 :例如k和k1的字段内容两者去重后的次数
GET /test/_search
{
"aggs": {
"a": {
"terms": {
"size": 1000,
"script": {
"source": """if (doc['k.keyword'].size()>0 && doc['k1.keyword'].size() > 0 ) return doc['k.keyword'].value +','+ doc['k1.keyword'].value; else return '1';"""
},
"min_doc_count": 1
}
}
}
结果如下
{
"took" : 145,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 1,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 10,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
},
"aggregations" : {
"a" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "kv,k1v",
"doc_count" : 6
},
{
"key" : "kv1,k1v",
"doc_count" : 3
},
{
"key" : "1",
"doc_count" : 1
}
]
}
}
}
**
示例1:
**
aggs和bool联用
GET index/_search
{
"size": 0,
"aggs": {
"all": {
"terms": {
"size": 1000,
"script": {
"source": " 可用if 语句判断,返回取值"
},
"min_doc_count": 1
}
}
},
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-10d",
"to": "now"
}
}
},
{
"query_string": {
"query": " 匹配 "
}
}
],
"must_not": [
{
"query_string": {
"query": " 不匹配"
}
}
]
}
}
}
示例2
GET index/_search
{
"size": 0,
"aggs": {
"location": {
"terms": {
"size": 5,
"field": "单独返回字段",
"min_doc_count": 1
}
}
},
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-1d",
"to": "now"
}
}
},
{
"query_string": {
"query": "匹配"
}
}
],
"must_not": [
{
"query_string": {
"query": """ 不匹配"""
}
}
]
}
}
}