文档目录： https://www.elastic.co/guide/index.html
GET _search
{
"query": {
"match_all": {}
}
}GET /_template/*PUT /_template/hs_server_template
{
"order": 0,
"version": 60001,
"index_patterns": [
"hs_server*"
],
"settings": {
"index": {
"refresh_interval": "5s"
}
},
"mappings": {
"doc": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"ErrorCode": {
"type": "integer"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip",
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
},
"responseLogTime": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss.SSS||yyyy-MM-dd||epoch_millis||yyyy-MM-dd HH:mm:ss.SSSZ"
}
}
}
},
"aliases": {}
}
}DELETE /_template/my_test_play_dur_templatePUT /_template/tv_stats_play_dur_template
{
"order": 0,
"version": 60001,
"index_patterns": [
"tv_stats_play_dur*"
],
"settings": {
"index": {
"refresh_interval": "30s"
}
},
"mappings": {
"doc": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"@version": {
"type": "keyword"
},
"remote_address": {
"type": "ip"
},
"duration": {
"type": "long"
},
"id": {
"type": "long"
},
"importbatchno": {
"type": "keyword"
},
"index_name_suffix": {
"type": "keyword"
},
"mac": {
"type": "keyword"
},
"main_id": {
"type": "long"
},
"main_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"sub_id": {
"type": "long"
},
"sub_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"type_name": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"url": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"userid": {
"type": "long"
},
"versioncode": {
"type": "keyword",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
},
"aliases": {}
}GET /tv_stats_play_dur-2019-06-05/_search/
DELETE /my_test-2019.05.10
GET /my_test-2019.05.13/_search#query
GET /tv_stats_play_dur*/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"root_id": 5
}
},
{
"match": {
"sub_id": 0
}
}
],
"must_not": [
{ "match": { "root_name": "直播" } }
]
}
}
}#batch update or bulk update
POST /tv_stats_play_dur*/doc/_update_by_query?conflicts=proceed
{
"query": {
"bool": {
"must": [
{
"term": {
"root_id": 5
}
},
{
"match": {
"sub_id": 0
}
}
],
"must_not": [
{
"match": {
"root_name": "直播"
}
}
]
}
},
"script": {
"lang": "painless",
"source": "ctx._source.root_name = params.live_name",
"params": {
"live_name": "直播"
}
}
}# get count num of null root by root,main,sub
GET /tv_stats_play_dur-2019-06-07*/_search?search_type=dfs_query_then_fetch
{
"query": {
"bool": {
"must_not": [
{
"exists": {
"field": "root_name.keyword"
}
}
]
}
},
"aggs": {
"root_id": {
"terms": {
"field": "root_id",
"size": 25
},
"aggs": {
"main_id": {
"terms": {
"field": "main_id",
"size": 25
},
"aggs": {
"sub_id": {
"terms": {
"field": "sub_id",
"size": 25
}
}
}
}
}
}
}
}#root name null group by date
GET /tv_stats_play_dur-2019-06*/_search?search_type=dfs_query_then_fetch
{
"query": {
"bool": {
"must_not": [
{
"exists": {
"field": "root_name.keyword"
}
}
]
}
},
"aggs": {
"root_id": {
"terms": {
"field": "importbatchno",
"size": 25
}
}
}
}#search by import date
GET /tv_stats_play_dur*/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"importbatchno": 20190610
}
}
]
}
}
}#delete by import date
POST /tv_stats_play_dur*/doc/_delete_by_query
{
"query": {
"bool": {
"must": [
{
"term": {
"importbatchno": 201906101
}
}
]
}
}
}##########################
GET /hs_server_ahc_task*/_search
{
“query”: {
“bool”: {
“must”: [
{
“bool”: {
“should”: [
{
“match”: {
“LogMessage”: “Error”
}
},
{
“match”: {
“LogMessage”: “MessagePull”
}
}
]
}
}
]
}
}
}
es同个字段，多个值搜索的案例
类似 a_field like ‘%wordA%’ and a_field like ‘%wordB%’
search_pdf_query = {"query": {
"bool":
{
"must": [
{"bool": {"should":[{"match_phrase": {"pdf_title":"年度报告"}},{"match_phrase":{"pdf_title":"季度报告"}}]}},
{"range": {"announce_date": {"gte": "2017-01-01","lte": "2018-12-31"}}},
{"terms": {"html_status": ["201", "300", "301", "302"]}},
{"terms": {"trade_code.keyword": ["600548","000548"]}}],
"must_not": [{"wildcard": {"origin_title.keyword": '*摘要'}},{"wildcard": {"origin_title.keyword": '*年度报告书'}}],
}},
"sort": [{"announce_date": "asc"}]
}
查找值包含某些文本的情况：
- 完全匹配情况下，对同一个字段的多个值搜索，使用terms查询,举例：
{"terms": {"html_status": ["201", "300", "301", "302"]}} - 如果不完全匹配，则在must里添加bool查询，再在bool里添加should查询,举例：
{"bool": {"should":[{"match_phrase": {"pdf_title":"年度报告"}},{"match_phrase":{"pdf_title":"季度报告"}}]}}
如何区分使用match,match_phrase,term可参考此篇
https://blog.csdn.net/camelcanoe/article/details/79544155
这里也涉及到查询的字段是否是 NOT_ANALYZED，ANALYZED字段无法使用term，只能使用match_phrase。
所以在新建index的时候需要把mapping设置好，哪些字段是ANALYZED，哪些是NOT_ANALYZED（感觉是个坑）
