目录

查询

合并查询

官方指导

查询

这种查询表达式，查询索引kvedr-account-statistics为例

GET kvedr-account-statistics/_search
{"query": { "match_all": {} }}

GET kvedr-hostevents-2022.05.11/_search
{
	"query": {
		"match_all": {}
	},
	"from": 1,
	"size": 3,
	"sort": {
		"_id": {
			"order": "desc"
		}
	}
}

GET kvedr-hostevents-2022.05.11/_search
{
	"query": {
		"match": {
			"doc.event.hdr.puid": "00627b1e71004b8c"
		}
	},
	"from": 0,
	"size": 10,
	"sort": {
		"@timestamp": {
			"order": "desc"
		}
	}
}

合并查询

多个and条件查询就需要用到bool。

GET kvedr-hostevents-2022.05.12/_search
{
  "from": 0,
  "size": 10,
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ], 
  "query": {
    "bool": {
      "must": [
        {"term": {"doc.event.hdr.type": {"value": 7}}},
        {"term": {"doc.event.log.type": {"value": "postfix"}}}
      ]
    }
  }
}

官方指导

符合查询

{
    "bool": {
        "must":     { "match": { "tweet": "elasticsearch" }},
        "must_not": { "match": { "name":  "mary" }},
        "should":   { "match": { "tweet": "full text" }},
        "filter":   { "range": { "age" : { "gt" : 30 }} }
    }
}

复合条件嵌套查询

{
    "bool": {
        "must": { "match":   { "email": "business opportunity" }},
        "should": [
            { "match":       { "starred": true }},
            { "bool": {
                "must":      { "match": { "folder": "inbox" }},
                "must_not":  { "match": { "spam": true }}
            }}
        ],
        "minimum_should_match": 1
    }
}