文章目錄

• • 1. exercise01: query size,from,should,highlight,pagination,sort
  • 2. exercise02: term query,compound query, fuzzy query, date query
  • 3. exercise03: search template, script query, scroll query.

1. exercise01: query size,from,should,highlight,pagination,sort

# ** EXAM OBJECTIVE: QUERIES ** # GOAL: Create search queries for analyzed text, highlight, # pagination, and sort# REQUIRED SETUP: # (i) a running Elasticsearch cluster with at least one node and # a Kibana instance, # (ii) add the "Sample web logs" and "Sample eCommerce orders" to # Kibana # Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # string "Firefox"GET kibana_sample_data_logs/_search {"query": {"match": {"message": "Firefox"}} } # Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # string "Firefox" and return (up to) 50 results. # As above, but return up to 50 results with an offset of 50 from # the firstGET kibana_sample_data_logs/_search {"query": {"match": {"message": "Firefox"}},"from": 50, "size": 50 } # Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # strings "Firefox" or "Kibana"GET kibana_sample_data_logs/_search {"query": {"match": {"message": "Firefox Kibana"}} }# Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing both the # strings "Firefox" and "Kibana" GET kibana_sample_data_logs/_search {"query": {"bool": {"must": [{"match": {"message": "Firefox"}},{"match": {"message": "Kibana"}}]}} }# Search for documents with the `message` field containing at least # two of the following strings: "Firefox", "Kibana", # "159.64.35.129" GET kibana_sample_data_logs/_search {"query": {"bool": {"should": [{"match": {"message": "Firefox"}},{"match": {"message": "Kibana"}},{"match": {"message": "159.64.35.129"}}],"minimum_should_match": 2}} } # Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # strings "Firefox" or "Kibana" # As above, but also return the highlights for the `message` field # As above, but also wrap the highlights in "{{" and "}}"GET kibana_sample_data_logs/_search {"query": {"match": {"message": "Firefox Kibana"}},"highlight": {"fields": {"message": {"pre_tags": "{{","post_tags": "}}"}}} }# Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # phrase "HTTP/1.1 200 51"GET kibana_sample_data_logs/_search {"query": {"match_phrase": {"message": "HTTP/1.1 200 51"}} }# Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `message` field containing the # phrase "HTTP/1.1 200 51", and sort the results by the # `machine.os` field in descending order # As above, but also sort the results by the `timestamp` field in # ascending orderGET kibana_sample_data_logs/_search {"query": {"match_phrase": {"message": "HTTP/1.1 200 51"}},"sort": [{"machine.os.keyword": {"order": "desc"}},{"timestamp": {"order": "asc"}}] } ### Run the next queries on the `kibana_sample_data_ecommerce` index # Search for documents with the `day_of_week` field containing the # string "Monday" # As above, but sort the results by the `products.base_price` field #in descending order, picking the lowest value of the arrayGET kibana_sample_data_ecommerce/_mapping GET kibana_sample_data_ecommerce/_search {"query": {"match": {"day_of_week": "Monday"}},"sort": [{"products.base_price": {"order": "desc","mode": "min"}}] }

2. exercise02: term query,compound query, fuzzy query, date query

# ** EXAM OBJECTIVE: QUERIES ** # GOAL: Create search queries for terms, numbers, dates, fuzzy, and # compound queries # REQUIRED SETUP: # (i) a running Elasticsearch cluster with at least one node and a # Kibana instance, # (ii) add the "Sample web logs" and "Sample flight data" to Kibana####Run the next queries on the `kibana_sample_data_logs` index # Filter documents with the `response` field greater or equal to 400 # and less than 500 # As above, but add a second filter for documents with the `referer` # field matching "http://twitter.com/success/guion-bluford"filter是可以使用數(shù)組的奧, referer是keyword類型的 GET kibana_sample_data_logs/_search {"query": {"bool": {"filter": [{"range": {"response": {"gte": 400,"lt": 500}}},{"term": {"referer": "http://twitter.com/success/guion-bluford"}}]}} }#Run the next queries on the `kibana_sample_data_logs` index # Filter documents with the `referer` field that starts by # "http://twitter.com/success" # Filter documents with the `request` field that starts by "/people"這里忘了term級(jí)別的前綴匹配使用prefix即可，在term level查詢中有 GET kibana_sample_data_logs/_search {"query": {"bool": {"filter": [{"prefix": {"referer": "http://twitter.com/success"}},{"match_phrase_prefix": {"request": "/people"}}]}} }#Run the next queries on the `kibana_sample_data_logs` index # Filter documents with the `memory` field containing any indexed # value # (opposite of above) Filter documents with the `memory` field not # containing any indexed valueGET kibana_sample_data_logs/_search {"query": {"bool": {"filter": {"exists": {"field": "memory"}}}} }GET kibana_sample_data_logs/_search {"query": {"bool": {"must_not": [{"exists": {"field": "memory"}}]}} } #Run the next queries on the `kibana_sample_data_logs` index # Search for documents with the `agent` field containing the string # "Windows" and the `url` field containing the string "name:john" # As above, but also filter documents with the `phpmemory` field # containing any indexed valueGET kibana_sample_data_logs/_search {"query": {"bool": {"must": [{"match": {"agent": "Windows"}},{"match_phrase": {"url": "name:john"}}],"filter": {"exists": {"field": "phpmemory"}}}} }# Search for documents that have either the `response` field greater # or equal to 400 or the `tags` field having the string "error" GET kibana_sample_data_logs/_search {"query": {"bool": {"should": [{"range": {"response": {"gte": 40}}},{"match": {"tags": "error"}}],"minimum_should_match": 1}} }# Search for documents with the `tags` field that does not contain # any of the following strings: "warning", "error", "info" GET kibana_sample_data_logs/_mappingGET kibana_sample_data_logs/_search {"query": {"bool": {"must_not": [{"match": {"tags": "warning, error, info"}}]}} }#Run the next queries on the `kibana_sample_data_logs` index # Filter documents with the `timestamp` field containing a date # between today and one week ago這個(gè)date的處理還需要學(xué)習(xí) GET kibana_sample_data_logs/_search {"query": {"range": {"timestamp": {"gte": "now-1w/d","lte": "now/d"}}},"sort": [{"timestamp": {"order": "asc"}}] }### Run the next queries on the `kibana_sample_data_flights` index # Filter documents with either the `OriginCityName` or the # `DestCityName` fields matching the string "Sydney" # As above, but allow inexact fuzzy matching, with a maximum allowed # “Levenshtein Edit Distance” set to 2. Test that the query # strings "Sydney", "Sidney" and "Sidnei" always return the same # number of resultsGET kibana_sample_data_flights/_mapping GET kibana_sample_data_flights/_search {"query": {"bool": {"should": [{"match": {"OriginCityName": {"query": "Sidnei","fuzziness": 2}}},{"match": {"DestCityName": {"query": "Sidnei","fuzziness": 2}}}],"minimum_should_match": 1}} }第二種解法 GET kibana_sample_data_flights/_search {"query": {"multi_match": {"query": "Sidnei","fields": ["OriginCityName","DestCityName"],"fuzziness": 2,"type": "best_fields"}} }

3. exercise03: search template, script query, scroll query.

這里的template的使用還是要熟悉一下才行，update ， query_template在使用stored的script的方式

# ** EXAM OBJECTIVE: QUERIES ** # GOAL: Use scroll API, search templates, script queries # REQUIRED SETUP: # (i) a running Elasticsearch cluster with at least one node and a # Kibana instance, # (ii) add the "Sample web logs" and "Sample flight data" to Kibana# Search for all documents in all indices # As above, but use the scroll API to return the first 100 results # while keeping the search context alive for 2 minutes # Use the scroll id included in the response to the previous query # and retrieve the next batch of resultsPOST /_search?scroll=1m {"size": 100,"query": {"match_all": {}} }POST /_search/scroll {"scroll" : "1m", "scroll_id" : "DnF1ZXJ5VGhlbkZldGNoBwAAAAAAAZFPFnZsLWtJUW0yU2d5Nl9POVM1dXVsTFEAAAAAAAGRUBZ2bC1rSVFtMlNneTZfTzlTNXV1bExRAAAAAAABkVEWdmwta0lRbTJTZ3k2X085UzV1dWxMUQAAAAAAAZFTFnZsLWtJUW0yU2d5Nl9POVM1dXVsTFEAAAAAAAGRUhZ2bC1rSVFtMlNneTZfTzlTNXV1bExRAAAAAAABkVQWdmwta0lRbTJTZ3k2X085UzV1dWxMUQAAAAAAAZFVFnZsLWtJUW0yU2d5Nl9POVM1dXVsTFE=" }### Run the next queries on the `kibana_sample_data_logs` index # Filter documents with the `response` field greater or equal to 400 這里可能有問題，因?yàn)檫@個(gè)字段被設(shè)置為string類型了，是不是要用filter,script來處理了。 GET kibana_sample_data_logs/_search {"query": {"range": {"response.keyword": {"gte": 400}}} } # Create a search template for the above query, so that the template # (i) is named "with_response_and_tag", # (ii) has a parameter "with_min_response" to represent the lower bound of the `response` field, # (iii) has a parameter "with_max_response" to represent the upper bound of the `response` field, # (iv) has a parameter "with_tag" to represent a possible value of the `tags` field# Test the "with_response_and_tag" search template by setting the # parameters as follows: # (i) "with_min_response": 400, # (ii) "with_max_response": 500 # (iii) "with_tag": "security"先寫query {"template_output" : {"query" : {"bool" : {"must" : [{"range" : {"response" : {"gte" : "400","lte" : "500"}}},{"match" : {"tags" : "security"}}]}}} }根據(jù)query寫scriptPUT _scripts/with_response_and_tag {"script": {"lang": "mustache","source": {"query": {"bool": {"must": [{"range": {"response": {"gte": "{{with_min_response}}", #這兩個(gè)值會(huì)變成字符串的形式，理論上是有問題的，不能這樣做的。正確的做法是將整個(gè)source中的json做成一個(gè)轉(zhuǎn)義后的字符串才行。"lte": "{{with_max_response}}"}}},{"match": {"tags": "{{with_tag}}"}}]}}}} }GET kibana_sample_data_logs/_search/template {"id": "with_response_and_tag","params": {"with_min_response": 400,"with_max_response": 500,"with_tag": "security"} }GET _render/template/with_response_and_tag {"params": {"with_min_response": 400,"with_max_response": 500,"with_tag": "security"} }返回 {"template_output" : {"query" : {"bool" : {"must" : [{"range" : {"response" : {"gte" : "400","lte" : "500"}}},{"match" : {"tags" : "security"}}]}}} }更好的template應(yīng)該寫成(使用kibana的特殊展示功能，挺好的) PUT _scripts/with_response_and_tag05 {"script": {"lang": "mustache","source":"""{"query": {"bool": {"must": [{"range": {"response": {"gte": {{with_min_response}}, "lte": {{with_max_response}}}}},{"match": {"tags": "{{with_tag}}"}}]}}}"""} } # Update the "with_response_and_tag" search template, so that (i) if # the "with_max_response" parameter is not set, then don't set an # upper bound to the `response` value, and (ii) if the "with_tag" # parameter is not set, then do not apply that filter at all # Test the "with_response_and_tag" search template by setting only # the "with_min_response" parameter to 500 # Test the "with_response_and_tag" search template by setting the # parameters as follows: (i) "with_min_response": 500, (ii) # "with_tag": "security"先寫query {"template_output" : {"query" : {"bool" : {"must" : [{"range" : {"response" : {"gte" : "400","lte" : "500"}}},{"match" : {"tags" : "security"}}]}}} }然后使用mustache的條件處理邏輯POST _scripts/with_response_and_tag03 {"script": {"lang": "mustache","source": """{"query": {"bool": {"must": [{"range": {"response": {"gte": {{with_min_response}}{{#with_max_response}},"lte": {{with_max_response}}{{/with_max_response}}}}}{{#with_tag}},{"match": {"tags": "{{with_tag}}"}}{{/with_tag}}]}}} """} }可以把后面兩個(gè)參數(shù)去掉進(jìn)行測(cè)試 GET _render/template/with_response_and_tag03 {"params": {"with_min_response": 400,"with_max_response": 500,"with_tag": "security"} } 超強(qiáng)干貨來襲 云風(fēng)專訪：近40年碼齡，通宵達(dá)旦的技術(shù)人生

總結(jié)

以上是生活随笔為你收集整理的06.德国博士练习_08_query_dsl的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。