ELK学习总结（3-1）elk的基本查询

基本查询：内置条件

组合查询：组合基本查询

过滤：查询同时，通过filter筛选数据

准备工作 

GET /library/books/_mget

{

"ids":["1","2","3","4","5","6"]

}

GET /library/_mapping

0、简单的查询

请求信息

GET /library/books/_search?q=title:elasticsearch

GET /library/_search?q=title:mongodb

GET /_search?q=title:blacksmith

1、term、terms查询：查询包含关键词

功能描述：term查询，查询某个字段例有某个关键词的文档

请求消息：

GET /library/books/_search

{

"query":{

"term":{

"preview":"elasticsearch"

}

}

}

功能描述：terms查询，查询某个字段例有多个关键词的文档，minimum_match(1,至少有一个关键词存在)

请求消息：

GET /library/books/_search

{

"query":{

"terms":{

"preview":["elasticsearch","book"],

"minimun_match":1

}

}

}

 

2、from、size: 控制查询返回的数量

请求信息

GET /library/books/_search?q=title:elasticsearch

GET /library/books/_search

{

"from":1,

"size":2,

"query":{

"term":{

"title":"elasticsearch"

}

}

}

3、返回版本号_version

请求信息

GET /library/books/_search

{

"version":true,

"query":{

"term":{

"preview":"elasticsearch"

}

}

}

4、match查询: 和term查询区别，会使用分析器

请求信息

GET /library/books/_search

{

"from":1,

"size":2,

"query":{

"term":{

"title":"elasticsearch"

}

}

}

3、返回版本号_version

请求信息

GET /library/books/_search

{

"version":true,

"query":{

"match":{

"preview":"elasticsearch"

}

}

}

GET /library/books/_search

{

"version":true,

"query":{

"match":{

"price":11

}

}

}

match_all 查询指定索引下的所有文档？

GET /library/books/_search

{

"query":{

"match_all":{}

}

}

match_phrase: 短语查询，slop定义关键词之间间隔多少位置单词

GET /library/books/_search

{

"query":{

"match_phrase":{

"preview":{

"query":"elasticsearch,distributed",

"slop":2

}

}

}

}

multi_match:可以查询指定多个字段都包含某个关键字的文档

GET /library/books/_search

{

"query":{

"multi_match":{

"query":"elasticsearch",

"fields":["title","preview"]

}

}

}

指定返回的字段

只能返回store为yes的字段

GET /library/books/search

{

"fields":["title","preview"],

"query":{

"match":{

"preview":"elasticsearch"

}

}

}

控制加载的字段：

GET /library/books/search

{

"partial_fields":{

"partial":{

"include":["preview"],

"exclude":["title","price"]

}

},

"query":{

"match":{

"preview":"elasticsearch"

}

}

}

5、排序查询: sort、asc/desc

请求信息

GET /library/books/_search

{

"query":{

"match_all":{}

}，

"sort":[

{

"price":{

"order":"desc"

}

}

]

}

响应信息

6、prefix前缀匹配查询

请求信息

GET /library/books/_search

{

"query":{

"prefix":{

"title":{

"value":"ret"

}

}

}

}

响应信息

7、range范围查询（range，from，to，include_lower,include_upper,boost）

include_lower:包含范围左边界，默认是true

include_upper:包含范围右边界，默认是true

请求信息

GET /library/books/_search

{

"query":{

"range":{

"publish_date":{

"from":"2015-01-01",

"to":"2015-07-01"

}

}

}

}

GET /library/books/_search

{

"query":{

"range":{

"price":{

"from":"10.00",

"to":"20.00",

"include_lower":true,

"include_upper":true

}

}

}

}

响应信息

8、wildcard查询--很影响性能

*  代表1-n个字符

？ 代表一个字符

请求信息

GET /library/books/_search

{

"query":{

"wildcard":{

"preview":“luc？ne”

}

}

}

响应信息

9、fuzzy模糊查询--很耗性能

value

boost

min_similarity

prefix_length

max_expansions

请求信息

GET /library/books/_search

{

"query":{

"fuzzy":{

"preview":“rabbit”,

"min_similarity":0.5

}

}

}

fuzzy_like_this

fuzzy_like_this_field

响应信息

10、more_like_this&more_like_this_field查询

fields:

like_text

percent_terms_to_match

min_term_freq

stop_words

min_doc_freq

min_word_len

max_word_len

boost_terms

boost

analyer