Kibana Devtool 常用命令

1、计算总数

{
  "size": 0,
  "aggs": {
    "count_nameCount": {
      "terms": {
        "field": "data.id"
      }
    }
  }
}

2、查询所有

GET /logstandard_data/logstandard_data/_search
{
  "query": {
    "match_all": {}
  }
}

3、查询某个字段匹配

GET /logstandard_data/logstandard_data/_search
{
 "query" : {
  "bool" : {
   "must" : [
    {"match": {"data.bsm": 574599426}}
   ]
  }
 }
}

4、查询某个字段，按时间倒叙排序

GET /logstandard_data/logstandard_data/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "data.interfaceCode": 1341
          }
        }
      ]
    }
  },
  "sort": [
    {
      "data.requestTime.keyword": {
        "order": "desc"
      }
    }
  ]
}

5、时间范围查询

GET /logstandard_data/logstandard_data/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "data.interfaceCode": 1341
          }
        },
        {
           "match": {
            "resource.status": "0"
          }
        }
      ], 
      "filter":[
        {"range": {
          "data.requestTime": {
            "gte": 1594915200000,
            "lte": 1595001599000
          }
      
        }
         
        }
        ]
    }
  },
  "sort": [
    {
      "data.requestTime.keyword": {
        "order": "desc"
      }
    }
  ]
}

 6、创建索引

PUT test

　　上面没有设置分片，就默认主分片为5，副分片为1

　　设置分片闯将索引

PUT /test
{
    "settings":{
        "index":{
            "number_of_shards":3,
            "number_of_replicas":1
          }
     }
}

　　number_of_shards是主分片的数量；number_of_replicas是副本分片的数量(这里提一下，number_of_replicas副本分片的数量是面向主分片的，所以这个值为1时代表每一个主分片有一个副本分片)

　　引用：https://www.cnblogs.com/progor/p/11548269.html#%E5%88%9B%E5%BB%BA%E7%B4%A2%E5%BC%95

7、设置索引数据中格式

POST /book/novel/_mappings
{
    "novel":{
        "properties": {
            "word_count": {
                "type": "integer"
            },
            "author": {
                "type": "keyword"
            },
            "title": {
                "type": "text"
            }
        }
    }
}

　　book为索引名，novel为type类型

　　字段数据类型：请查看https://www.cnblogs.com/chy18883701161/p/12723658.html

　　设置日期的格式可以

PUT my_index
{
  "mappings": {
    "_doc": {
      "properties": {
        "updated_date": {
          "type":   "date",
          "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
        }
      }
    }
  }
}

　　设置对象中包含对象的类型

{
    "properties": {
        "region": {
            "type": "keyword"
        },
        "manager": {
            "properties": {
                "age": {"type": "short"},
                "name": {
                    "properties": {
                        "first": {"type": "keyword"},
                        "last": {"type": "text"}
                    }
                }
            }
        }
    }
}

8、插入数据

POST indextest001/product
{
  "title": "test title 001",
  "description": "this is a random desc ",
  "price": 22.6,
  "onSale": "true",
  "type": 2,
  "createDate": "2018-01-12"

}