查询全部:
POST /gwrec/rdb/_search
{
"query":{
"match_all":{}
}
}
注:gwrec为库名(index),rdb为type,_search为请求方式
- elasticsearch-head插件
- sense插件
下同,不再赘述。
单条件查询:
POST /macasset/rdb/_search
{
"query": {
"match": {
"MAC_ADDRESS": "XXXXXXXXXXXX"
}
}
}
随机获取多条数据:
POST /macasset/rdb/_search
{
"from": 0,
"size": 1,
"sort": {
"_script": {
"script": "Math.random()",
"type": "number"
}
}
}
分组查询:
POST /macasset/rdb/_search
{
"size": 0,
"aggs": {
"nu": {
"terms": {
"field": "PROV_CODE.keyword",
"size": 40
}
}
}
}
注:关于.keyword文末说明
单条件分组查询:
POST /macasset/rdb/_search
{
"size": 10,
"query": {
"match": {
"MODEL": "Ltd"
}
},
"aggs": {
"nu": {
"terms": {
"field": "VENDOR.keyword",
"size": 40
}
}
}
}
删除索引:
DELETE /macasset
删除索引库中的数据:
POST /macasset/rdb/_delete_by_query
{
"query": {"match_all": {}}
}
注:根据查询结果删
千条查询:
POST /macasset/rdb/_search
{
"size":1000,
"query":{
"bool":{
"filter":[{
"bool":{
"should":[
{
"match_phrase":{
"MAC_ADDRESS":{
"query":"MAC地址1"
}
}
},
{
"match_phrase":{
"MAC_ADDRESS":{
"query":"MAC地址2"
}
}
},
....
{
"match_phrase":{
"MAC_ADDRESS":{
"query":"MAC地址1000"
}
}
},
]
}
}]
}
}
}
注:代码中可以循环拼接mac地址,查到的数据会一起返回。
查看索引字段类型:
GET /gwrec/_mapping
注:存数据时注意,字段类型对应,long-long,text-String
查看存在该字段的数据:
POST /macasset/rdb/_search
{
"query": {
"bool": {
"must": [
{
"exists": {
"field": "SOURCE_FROM"
}
}
]
}
}
}
多条件精准查询:
POST /macasset/rdb/_search
{
"from": 0,
"size": 50,
"query": {
"bool": {
"must": [{
"term": {
"MODEL.keyword": "查询信息1"
}
},
{
"term": {
"HARDWAREVER.keyword": "查询信息2"
}
},
{
"term": {
"VENDOR.keyword": "查询信息3"
}
},
{
"range": {
"ACCESS_TIME": {
"gte": 1568776037000,
"lte": 1571817697000
}
}
}
]
}
},
"sort": {
"UPDATE_TIME": {
"order": "desc"
}
}
}
注:
- from :从第几条开始查,起始为0
- size :查询几条数据
- sort :排序规则,desc降序,asc升序
- rang :范围查询
gte:大于等于
gt:大于
lte:小于等于
lt:小于
查询后多级分组:
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"term": {
"VENDOR.keyword": "SKYW"
}
},
{
"term": {
"MODEL.keyword": "DT541-zhengqi"
}
},
{
"term": {
"HARDWAREVER.keyword": "V1.0"
}
},
{
"range": {
"ACCESS_TIME": {}
}
}
]
}
},
"aggs": {
"nu": {
"terms": {
"field": "PROV_CODE",
"size": 40
},
"aggs": {
"num": {
"terms": {
"field": "VENDOR.keyword",
"size": 1000
},
"aggs": {
"numm": {
"terms": {
"field": "MODEL.keyword",
"size": 1000
},
"aggs": {
"nummm": {
"terms": {
"field": "HARDWAREVER.keyword",
"size": 1000
},
"aggs": {
"nummmn": {
"terms": {
"field": "FIRMWARE_VER.keyword",
"size": 1000
},
"aggs": {
"nummmnn": {
"terms": {
"field": "MW_VER.keyword",
"size": 1000
}
}
}
}
}
}
}
}
}
}
}
}
}
}
and,or组合查询:
查询规则:STATUS=1 或 STATUS=0&&OFFLINE_TIME> 1557849600000
外加分省查询
{
"size": 0,
"query": {
"bool": {
"should": [
{
"bool": {
"must": [
{
"term": {
"STATUS": "1"
}
},
{
"terms": {
"PROV_CODE": [1, 2, 3]
}
}
]
}
},
{
"bool": {
"must": [
{
"term": {
"STATUS": "0"
}
},
{
"range": {
"OFFLINE_TIME": {
"gte": 1557849600000
}
}
},
{
"terms": {
"PROV_CODE": [1, 2, 3]
}
}
]
}
}]
}
}
}
注:should默认其中条件满足一条即可,之所以把PROV_CODE分两次写进查询条件,是因为测试数据有误。
手动移动索引库分片:
curl -XPOST 'http://192.168.111.31:9200/_cluster/reroute' -d '{
"commands":[{
"move":{
"index":"macasset",
"shard":4,
"from_node":"node-31",
"to_node":"node-35"
}}]}'
- index:索引库名
- shard:将要移动的分片
- from_node:从哪来
- to_node:到哪去
本文主要记录一些es的常用语句,关于踩坑日记见另一篇文章。