Elasticsearch-操作

==========================================================

基础调用

==========================================================

GET _search
{
  "query": {
    "match_all": {}
  }
}

GET _all/_mapping

#批量 - 新增
POST consumer/external/_bulk
{
    "index": {
        "_id": 1
    }
} 
{
    "name": "张三1"
}
{
    "index": {
        "_id": 2
    }
}
{
    "name": "李四2"
}

#批量 - 多种操作
POST /_bulk
{"delete":{"_index":"website","_type":"blog","_id":"123"}}
{"create":{"_index":"website","_type":"blog","_id":"1234"}}
{"title":"标题标题1"}
{"index":{"_index":"website","_type":"blog"}}
{"title":"标题标题2"}
{"update":{"_index":"website","_type":"blog","_id":"1234"}}
{"doc":{"title":"更新标题3"}}

POST /bank/account/_bulk
#查看文档里的数据, 批量添加

#修改数据
POST sjcj_1686899938271/_update/lfNCw4gBO7SX5G3qBn6Q?refresh=true
{
  "doc": {
    "wendu": "99摄氏度-update"
  },
  "doc_as_upsert": true
}

删除数据
POST sjcj_1688108431223/_delete_by_query
{
  "query": {
    "match_all": {}
  }
}

==========================================================

特殊点

==========================================================

设置ES的窗口返回数据最大值, 防止超出去查不到数据了
{“index”:{“max_result_window”:‘10000000’}}

数据迁移
POST _reindex
{
  "source": {
    "index": "bank"
  },
  "dest": {
    "index": "new-bank"
  }
}

==========================================================

查询相关 - 排序, 高亮(缺)

==========================================================

#url的条件查询
GET bank/_search?q=*&sort=account_number:asc

#查询- 根据字段排序
GET bank/_search
{
  "query":{
    "match_all": {}
  },
  "sort": [
    {
      "account_number": "asc"
    },
    {
      "balance": "desc"
    }
  ]
}
#查询 - 分页 + 排序
GET bank/_search
{
  "query": {
    "match_all": {
      
    }
  },
  "from": 0,
  "size": 3, 
  "sort": [
    {
      "balance": {
        "order": "desc"
      },
      "account_number": {
        "order": "desc"
      }
    }
  ]
}

#设置查询出几个字段, select balance,firstname from....
GET bank/_search
{
  "query": {
    "match_all": {
      
    }
  },
  "from": 0,
  "size": 3, 
  "sort": [
    {
      "balance": {
        "order": "desc"
      },
      "account_number": {
        "order": "desc"
      }
    }
  ],
  "_source": ["balance","firstname"]
}


#match全文检索会按照评分进行排序, 会对检索条件进行分词匹配,
#match精确查询(会分词+全文检索)
GET bank/_search
{
  "query": {
    "match": {
      "account_number":"20"
    }
  }
}
GET bank/_search
{
  "query": {
    "match": {
      "balance":16418
    }
  }
}

#match精确匹配包含Kings的
GET bank/_search
{
  "query": {
    "match": {
      "address":"Kings"
    }
  }
}
#match精确匹配包含Mill或者lane或者Mill Lane的
GET bank/_search
{
  "query": {
    "match": {
      "address":"Mill lane"
    }
  }
}

# 不进行分词, 精确查询 - 1
#match_puhras 短语匹配(不分词匹配)
GET bank/_search
{
  "query": {
    "match_phrase": {
      "address": "Mill lane"
    }
  }
}
# 不进行分词, 精确查询 - 2
#加了.keyword也可以进行精确的短语匹配, 相当于must = 这个值
GET bank/_search
{
  "query": {
    "match": {
      "address.keyword": "198 Mill Lane"
    }
  }
}

#multi_match 多字段匹配
#查询 state字段和address字段都包含mill的
GET bank/_search
{
  "query": {
    "multi_match": {
      "query": "mill",
      "fields": ["state","address","city"]
    }
  }
}


#bool复合查询
# match必须满足
# match_not 必须不满足
# should 匹配上也行, 不匹配上也行
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "address": "mill"
          }
        },
        {
          "match": {
            "gender": "M"
          }
        }
      ],
      "must_not": [
        {
          "match": {
            "age": "38"
          }
        },
        {
          "match": {
            "age": "39"
          }
        }
      ],
      "should": [
        {
          "match": {
            "lastname": "Wallace"
          }
        }
      ]
    }
  }
}


#filter 结果过滤
#年龄必须大于等于18, 小于等于30

#会有相关性得分 score
GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "age": {
              "gte": 18,
              "lte": 30
            }
          }
        }
      ]
    }
  }
}
#filter不会计算相关性得分 score
GET bank/_search
{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "age": {
            "gte": 18,
            "lte": 30
          }
        }
      }
    }
  }
}

GET bank/_search
{
  "query": {
    "bool": {
      "must": [
        {
         "match": {
           "address": "mill"
         }
        }
      ]
      ,"filter": {
        "range": {
          "age": {
            "gte": 18,
            "lte": 30
          }
        }
      }
    }
  }
}

#term 查询固定数值
GET bank/_search
{
  "query": {
    "match": {
      "age": "28"
    }
  }
}
# 和term一样, 但是这种精确值的, 推荐使用term
GET bank/_search
{
  "query": {
    "term": {
      "age": "28"
    }
  }
}
# 但是这种需要模糊匹配的, term就查询不到了
GET bank/_search
{
  "query": {
    "term": {
      "address": "789 Madiso"
    }
  }
}

#scroll滚动查询
GET sjcj_1686899938271/_search?scroll=2m
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "projectId": 1
          }
        }
      ]
    }
  }
  ,"size": 1
}
# 根据scrollId查询数据
POST _search/scroll?scroll=2m
{
  "scroll": "1m", 
  "scroll_id":"FGluY2x1ZGVfY29udGV4dF91dWlkDXF1ZXJ5QW5kRmV0Y2gBFnAxYTFoMWtiUTQ2ejFKZ3V5NW1GSWcAAAAAAAZ0rhZ3b0lBWmhpQ1RNUzBhemV3ekdFSjBn"
}

==========================================================

聚合相关

==========================================================

#agg聚合
# 查找address包含mill, 的年龄分组
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "aggs": {
    "ageAggsName": {
      "terms": {
        "field": "age",
        "size": 10
      }
    }
  }
}
# 查找address包含mill, 的平均年龄
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "aggs": {
    "customAvgAggs": {
      "avg": {
        "field": "age"
      }
    }
  }
}
#多个聚合, 同时查看查询结果
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "aggs": {
    "customAvgAggs": {
      "avg": {
        "field": "age"
      }
    },
    "customAgeAggs": {
      "terms": {
        "field": "age",
        "size": 10
      }
    },
    "customBalanceAvg":{
      "avg": {
        "field": "balance"
      }
    }
  }
}
#多个聚合
#只查看聚合信息,不查看查询结果
#设置size = 0, 去掉查询结果
GET bank/_search
{
  "query": {
    "match": {
      "address": "mill"
    }
  },
  "aggs": {
    "customAvgAggs": {
      "avg": {
        "field": "age"
      }
    },
    "customAgeAggs": {
      "terms": {
        "field": "age",
        "size": 10
      }
    },
    "customBalanceAvg":{
      "avg": {
        "field": "balance"
      }
    }
  },
  "size": 0
}

#两层聚合
#按照年龄聚合,并且请求这些年龄段的人的平均薪资
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "customAgeTerm": {
      "terms": {
        "field": "age",
        "size": 100
      },
      "aggs": {
        "balanceAvg": {
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  },
  "size": 0
}

#多个内嵌聚合
#查出所有年龄分布, 并且这些年龄段中M的平均薪资和F的平均薪资以及这个年龄段的总体平均薪资
GET bank/_search
{
  "query": {
    "match_all": {}
  },
  "aggs": {
    "ageGroup": {
      "terms": {
        "field": "age",
        "size": 100
      },
      "aggs": {
        "genderGroup": {
          "terms": {
            "field": "gender.keyword",
            "size": 10
          }
          ,"aggs": {
            "balanceGroup": {
              "avg": {
                "field": "balance"
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}



#查出所有年龄分布, 并且这些年龄段中M的平均薪资和F的平均薪资以及这个年龄段的总体平均薪资
GET bank/_search
{
  "query": {
    "match_all": {
      
    }  
  },
  "aggs": {
    "ageAvg": {
      "terms": {
        "field": "age",
        "size": 10
      },
      "aggs": {
        "genderGroup": {
          "terms": {
            "field": "gender.keyword",
            "size": 10
          },
          "aggs": {
            "banlanceByGenderGroup": {
              "avg": {
                "field": "balance"
              }
            }
          }
        },
        "balanceByAgeGroup":{
          "avg": {
            "field": "balance"
          }
        }
      }
    }
  },
  "size": 0
}

==========================================================

索引库结构相关

==========================================================

#text 类型会全文检索, 也就是说会分词搜索, 类似mysql的 like
#keyword 类型就是精确匹配, 必须等于这个值才会搜出来, 类似 mysql的 = 
PUT /my_index
{
  "mappings": {
    "properties": {
      "age":{"type": "integer"},
      "email":{"type": "keyword"}
      ,"name":{"type": "text"}
    }
  }
}

#修改索引库, 添加新字段
#注意这种方式, 只能用来添加新的字段, 无法修改原有字段
# index属性, true代表可以被检索, false代表无法检索, 用来控制这个字段是否能被搜索
PUT /my_index/_mapping
{
  "properties": {
      "employee-id":{"type": "keyword","index":true}
   }
}

PUT new-bank 
{
  "mappings": {
       "properties" : {
        "account_number" : {
          "type" : "long"
        },
        "address" : {
          "type" : "text"
        },
        "age" : {
          "type" : "integer"
        },
        "balance" : {
          "type" : "integer"
        },
        "city" : {
          "type" : "keyword"
        },
        "email" : {
          "type" : "keyword"
        },
        "employer" : {
          "type" : "keyword"
        },
        "firstname" : {
          "type" : "text"
        },
        "gender" : {
          "type" : "keyword"
        },
        "lastname" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "state" : {
          "type" : "keyword"
        }
    }
  }
}

==========================================================

分词器相关

==========================================================

#测试分词器
POST _analyze
{
  "analyzer": "standard",
  "text": ["尚硅谷电商项目"]
}


#测试分词器
POST _analyze
{
  "analyzer": "ik_smart",
  "text": ["尚硅谷电商项目"]
}

#测试分词器
POST _analyze
{
  "analyzer": "ik_max_word",
  "text": ["我是中国人"]
}


#扩展词库
POST _analyze
{
  "analyzer": "ik_max_word",
  "text": ["乔碧萝"]
}

==========================================================

测试需要是用到的索引库及数据

==========================================================


PUT new-bank 
{
  "mappings": {
       "properties" : {
        "account_number" : {
          "type" : "long"
        },
        "address" : {
          "type" : "text"
        },
        "age" : {
          "type" : "integer"
        },
        "balance" : {
          "type" : "integer"
        },
        "city" : {
          "type" : "keyword"
        },
        "email" : {
          "type" : "keyword"
        },
        "employer" : {
          "type" : "keyword"
        },
        "firstname" : {
          "type" : "text"
        },
        "gender" : {
          "type" : "keyword"
        },
        "lastname" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "state" : {
          "type" : "keyword"
        }
    }
  }
}

==========================================================

同盾查询

==========================================================



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "1"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1635868800000,
              "lte": 1635955199999
            }
          }
        }
      ]
    }
  }
  ,"_source": ["errorCode","responseData","serviceName"]
  ,"size": 2000
}

#Time 1
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "1"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1634400000000,
              "lte": 1642175999999
            }
          }
        }
        ,{
          "match": {
            "organizationCode": "8640  86400402 86400495 86400498 86400405 86400400"
          }
        }
      ]
    }
  }
  ,"aggs": {
    "nciBussSegmentAgg": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 1000
        ,"missing": "人工"
      }
      ,"aggs": {
        "businessServiceNameAgg": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 1000
          }
          ,"aggs": {
            "channelServiceNameAgg": {
              "terms": {
                "field": "channelServiceName.raw",
                "size": 1000
              }
              ,"aggs": {
                "statusCountAgg": {
                  "terms": {
                    "field": "success",
                    "size": 10000
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ,"from": 0,
  "size": 0
}


GET  freyr*/_mapping

GET  freyr*/_search


GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "2"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1637510400000,
              "lte": 1637596799000
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "nciBussSegmentAgg": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
      }
      ,"aggs": {
        "businessServiceNameAgg": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          }
          ,"aggs": {
            "statusCountAgg2": {
              "terms": {
                "field": "success",
                "size": 10
              }
              ,"aggs": {
                "chade": {
                  "terms": {
                    "field": "status",
                    "size": 10
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ,"size": 0
}






#Time 1
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "1"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1640793600000,
              "lte": 1640879999999
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "==业务环节==": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
        ,"missing": "KKK"
      }
      ,"aggs": {
        "==业务系统==": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          }
          ,"aggs": {
            "channelServiceNameAgg": {
              "terms": {
                "field": "channelServiceName.raw",
                "size": 10
              }
              ,"aggs": {
                "==成功失败==": {
                  "terms": {
                    "field": "success",
                    "size": 10
                  }
                  ,"aggs": {
                    "==seq==": {
                      "terms": {
                        "field": "sequenceId.raw",
                        "size": 10
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ,"from": 0
  ,"size": 0
}

#Time 2
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "2"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1638288000000,
              "lte": 1640275199999
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "==业务环节==": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
      }
      ,"aggs": {
        "==业务系统==": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          }
          ,"aggs": {
            "==成功失败==": {
              "terms": {
                "field": "success",
                "size": 10
              }
            }
          }
        }
      }
    }
  }
  ,"size": 0
}


#Time 3
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
        }
        ,{
          "match_phrase": {
            "channelSequenceId": "xsd20220127150646fbf7847f-e1af-4edc-9f6f-90d7a6145d83"
          }
        }
      ]
    }
  }
}


#暂时不使用
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {}
      ]
    }
  },
  "aggs": {
    "==业务环节==": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
      },
      "aggs": {
        "==业务系统==": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          },
          "aggs": {
            "channelServiceName": {
              "terms": {
                "field": "channelServiceName.raw",
                "size": 10
              },
                  "aggs": {
                    "==是否调用本地==": {
                      "terms": {
                        "field": "cacheFlag",
                        "size": 10
                      }
                    }
                }
            }
          }
        }
      }
    }
  },
  "size": 0
}


GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
        },
        {
          "range": {
            "recordTime": {
              "gte": 1639152000000,
              "lte": 1639238399999
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "==业务环节==": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
      }
      ,"aggs": {
        "==业务系统==": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          }
          ,"aggs": {
            "==成功失败==": {
              "terms": {
                "field": "invokeType",
                "size": 10
              }
              ,"aggs": {
                "==查得未查得==": {
                  "terms": {
                    "field": "status",
                    "size": 10
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ,"size": 0
}





GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
         {
          "match": {
            "invokeType": "2"
          }
        },
        {
          "range": {
            "recordTime": {
              "gte": 1639152000000,
              "lte": 1639238399999
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "==业务环节==": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 10
      }
      ,"aggs": {
        "==业务系统==": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 10
          }
          ,"aggs": {
            "==channelServiceName==": {
              "terms": {
                "field": "channelServiceName.raw",
                "size": 10
              }
              ,"aggs": {
                "NAME": {
                  "cardinality": {
                    "field": "channelSequenceId.raw"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  ,"size": 0
}








#查询异常切换量
GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "2"
          }
        },{
          "match": {
            "success": "false"
          }
        },{
          "range": {
            "recordTime": {
              "gte": 1638892800000,
              "lte": 1638979199999
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "NAME": {
      "cardinality": {
        "field": "channelSequenceId.raw"
      }
    }
  }
  ,"size": 0
}



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "recordTime": {
              "gte": 1637424000000,
              "lte": 1640102399999
            }
          }
        },
        {
          "match": {
            "status": "0"
          }
        }
        ,{
          "match": {
            "invokeType": "2"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "recordTime": {
        "unmapped_type": "long",
        "order": "desc"
      }
    }
  ]
  ,"size": 2000
}



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "recordTime": {
              "gte": 1637424000000,
              "lte": 1640102399999
            }
          }
        },
        {
          "match": {
            "status": "0"
          }
        },
        {
          "match": {
            "invokeType": "2"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "recordTime": {
         "unmapped_type": "long",
        "order": "desc"
      }
    }
  ],
  "_source": [
    "channelSequenceId",
    "responseData"
    ,"recordTime"
    ,"requestParam"
  ]
  ,"size": 3000
}




GET  freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "status": "1"
          }
        }
      ]
    }
  }
}



GET  freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "recordTime": {
              "gte": 1638288000000,
              "lte": 1638719999999
            }
          }
        },
        {
          "match": {
            "invokeType": "1"
          }
        }
        ,{
          "match": {
            "sequenceId.raw": "1638356514932A87166"
          }
        }
      ]
    }
    
  }
  ,"size": 200
}



GET  freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "sequenceId": "1640851872334A97583"
          }
        }
      ]
    }
    
  }
}





GET freyr*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
            "must": [
              {
                "terms": {
                  "invokeType": [
                    "1"
                  ]
                }
              },
              {
                "range": {
                  "recordTime": {
                    "gte": 1634400000000
                  }
                }
              },
              {
                "range": {
                  "recordTime": {
                    "lte": 1642175999999
                  }
                }
              },
              {
                "terms": {
                  "organizationCode": [
                    "8651",
                    "86510308"
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  },
  "sort": [
    {
      "recordTime": {
        "unmapped_type": "long",
        "order": "desc"
      }
    }
  ],
  "aggs": {
    "nciBussSegmentAgg": {
      "terms": {
        "field": "nciBussSegment.raw",
        "size": 1000
      },
      "aggregations": {
        "businessServiceNameAgg": {
          "terms": {
            "field": "businessServiceName.raw",
            "size": 1000
          },
          "aggregations": {
            "channelServiceNameAgg": {
              "terms": {
                "field": "channelServiceName.raw",
                "size": 1000
              },
              "aggregations": {
                "statusCountAgg": {
                  "terms": {
                    "field": "success",
                    "size": 1000
                  },
                  "aggregations": {
                    "sequenceIdAgg": {
                      "terms": {
                        "field": "sequenceId.raw",
                        "size": 2147483647
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "invokeType": "1"
          }
        }
        ,{
          "match": {
            "organizationCode": "86261300"
          }
        }
      ]
    }
  }
  ,"sort": [
    {
      "recordTime": {
         "unmapped_type": "long",
        "order": "desc"
      }
    }
  ]
  ,"size": 200
}

GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "nciCustType": "01"
          }
        }
        ,{
          "match": {
            "organizationCode": "86261300"
          }
        }
        ,{
          "match": {
            "invokeSource": "1"
          }
        }
      ]
    }
  }
  ,"sort": [
    {
      "recordTime": {
         "unmapped_type": "long",
        "order": "desc"
      }
    }
  ]
  ,"size": 200
}



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "serviceDisplayName": ""
          }
        }
      ]
    }
  }
}

GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "recordTime": {
              "gte": 1643040000000,
              "lte": 1643212799000
            }
          }
        }
      ]
    }
  }
  ,"aggs": {
    "nciBussSegmentGroup": {
      "terms": {
        "field": "serviceName.raw",
        "size": 10
      }
      ,"aggs": {
        "successGroup": {
          "terms": {
            "field": "success",
            "size": 10
          }
          ,"aggs": {
            "seq": {
              "terms": {
                "field": "msg.raw",
                "size": 10
              }
            }
          }
        }
      }
    }
  }
  ,"size": 0
}



GET freyr*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "recordTime": {
              "gte": 1643040000000,
              "lte": 1643212799000
            }
          }
        }
      ]
      
    }
  }
  ,"aggs": {
    "nciBussSegmentGroup": {
      "terms": {
        "field": "serviceName.raw",
        "size": 10
      }
      ,"aggs": {
        "successGroup": {
          "terms": {
            "field": "status",
            "size": 10
          }
        }
      }
    }
  }
  ,"size": 0
}

最后编辑于：2024.02.28 09:26:31

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 207,248评论 6赞 481
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 88,681评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 153,443评论 0赞 344
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 55,475评论 1赞 279
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 64,458评论 5赞 374
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 49,185评论 1赞 284
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,451评论 3赞 401
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 37,112评论 0赞 261
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 43,609评论 1赞 300
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 36,083评论 2赞 325
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 38,163评论 1赞 334
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,803评论 4赞 323
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 39,357评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 30,357评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,590评论 1赞 261
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 45,636评论 2赞 355
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,925评论 2赞 344

Elasticsearch-操作

基础调用

特殊点

查询相关 - 排序, 高亮(缺)

聚合相关

索引库结构相关

分词器相关

测试需要是用到的索引库及数据

同盾查询

推荐阅读更多精彩内容