elasticsearch复合查询

查询最近一小时内data.@level字段为Error的日志并按date倒序排列，输出最近10条,只输出[date,message]两个字段

GET events*/_search

{

    "query": {

                "bool": {

                    "must": [

                        {

                            "query_string": {

                                "fields": ["data.@level"],

                                "query": "Error"

                             

                        }

                        }

                         

                    ],

                "filter": {

                           "range": {

                      "date": {

                        "gte": "now-1h",

                        "lte": "now"

                      }

                    }

                }

                   

                }

                },

                "sort": [

                  {

                    "date": {

                      "order": "desc",

                      "missing": "_last"

                    }

                  }],

                  "_source": ["date","message"],

                  "size": 10

    }