SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
searchSourceBuilder.size(2000);
BoolQueryBuilder boolQueryBuilder= QueryBuilders.boolQuery();
MatchPhraseQueryBuilder matchPhraseQueryBuilder1 = QueryBuilders.matchPhraseQuery("body.bpInfo.reqInfo.url","/au/use/getUseRoes");
QueryBuilder matchQueryBuilder = QueryBuilders.rangeQuery("@timestamp").from(begin).to(end);
boolQueryBuilder.must(matchQueryBuilder);
boolQueryBuilder.must(matchPhraseQueryBuilder1 );
searchSourceBuilder.query(boolQueryBuilder);
上面是可以查出来数据的
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder(); searchSourceBuilder.size(2000);
BoolQueryBuilder boolQueryBuilder= QueryBuilders.boolQuery();
TermQueryBuilder termQueryBuilder = QueryBuilders.termQuery("body.bpointInfo.reqInfo.url", "/auth/use/getUseRoes");
QueryBuilder matchQueryBuilder = QueryBuilders.rangeQuery("@timestamp").from(begin).to(end);
boolQueryBuilder.must(matchQueryBuilder);
boolQueryBuilder.must(termQueryBuilder );
searchSourceBuilder.query(boolQueryBuilder);
这样是查不出来数据的，在此记录下。
并且通过elk生成时time和@timestamp不一样，@timestamp时间减8小时
