以下接口調(diào)用都基于5.5版本

JSON 文檔格式

{"_index": "zipkin-2017-09-06","_type": "span","_id": "AV5WSb1lKwYfgxikh_Fp","_score": null,"_source": {"timestamp_millis": 1504686226897,"traceId": "58d858be36d2493e","id": "eb5e8ee2ff39eaa7","name": "close","parentId": "47622e0c4229a48b","timestamp": 1504686226897000,"duration": 2,"binaryAnnotations": [{"key": "ip","value": "127.0.0.1","endpoint": {"serviceName": "redis","ipv4": "127.0.0.1","port": 20880}},{"key": "lc","value": "unknown","endpoint": {"serviceName": "redis","ipv4": "127.0.0.1","port": 20880}},{"key": "service","value": "redis","endpoint": {"serviceName": "redis","ipv4": "127.0.0.1","port": 20880}}]},"fields": {"timestamp_millis": [1504686226897]},"sort": [1504686226897] }

1.OR條件查詢格式

{"query":{"bool":{"should":[{},{},{}...}]}},"size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?should條件的意思就只要匹配到里面其中一個(gè)條件就可以命中, 如

{"query":{"bool":{"should":[{"match":{"traceId":"6edb691b4bc775b1"}},{"match":{"traceId":"7e5b391r4bc775b1"}}]}},"size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?只要traceId等于其中一個(gè)值就可以命中

?

2.AND 條件查詢格式

{"query":{"bool":{"must":[{},{},{}...}]}},"size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?must條件的意思就是必須匹配里面的所有條件才可以命中,如

{"query":{"bool":{"must":[{"range":{"timestamp":{"gte":1504581280866000,"lte":1504581280878000,"format":"date_time_no_millis"}}}, {"match":{"traceId":"6edb691b4bc775b1"}}],"must_not": {"exists": { "field": "parentId" } }}},"size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?必須匹配traceId=6edb691b4bc775b1, 并且時(shí)間范圍在1504581280866000,1504581280878000

?

3.是否含有某key

"must_not": {"exists": { "field": "parentId" } }

?意思是查詢必須沒有parenId這個(gè)key的數(shù)據(jù)

{"query":{ "bool":{"must":[{"range":{"timestamp":{"gte":1504581280866000,"lte":1504581280878000,"format":"date_time_no_millis"}}}, {"match":{"traceId":"6edb691b4bc775b1"}}],"must_not": {"exists": { "field": "parentId" } }}}, "size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?

PS: 不管是must,should,must_not都是平級(jí)的，包含在bool里面

?

4.嵌套查詢

{"query":{ "bool":{"must":[{"range":{"timestamp":{"gte":1504581280866000,"lte":1504581280878000,"format":"date_time_no_millis"}}}, {"match":{"traceId":"6edb691b4bc775b1"}},{"nested": {"path": "binaryAnnotations" ,"query": { "bool": {"must": [{ "match": { "binaryAnnotations.key": "service" }},{ "match": { "binaryAnnotations.value": "WebRequest" }}] } }}}],"must_not": {"exists": { "field": "parentId" } }}}, "size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?nested嵌套查詢和其他match,range條件一樣，是包含在must,should這些條件里面

{"nested": {"path": "binaryAnnotations" ,"query": { "bool": {"must": [{ "match": { "binaryAnnotations.key": "service" }},{ "match": { "binaryAnnotations.value": "WebRequest" }}] } }}}

?我們的JSON文檔里有binaryAnnotations這個(gè)key, 而value是一個(gè)數(shù)組, 嵌套查詢必須指定path，在我們這里就是binaryAnnotations,然后里面再使用query查詢，query里面的語法和外層的一樣

5.復(fù)合條件嵌套查詢

假設(shè)我們要查詢binaryAnnotations? 里面兩個(gè)并行的條件

{"query":{ "bool":{"must":[{"range":{"timestamp":{"gte":1504581280866000,"lte":1504581280878000,"format":"date_time_no_millis"}}}, {"match":{"traceId":"6edb691b4bc775b1"}},{"nested": {"path": "binaryAnnotations" ,"query": { "bool": {"must": [{ "match": { "binaryAnnotations.key": "service" }},{ "match": { "binaryAnnotations.value": "WebRequest" }}] } }}},{"nested": {"path": "binaryAnnotations" ,"query": { "bool": {"must": [{ "match": { "binaryAnnotations.key": "ip" }},{ "match": { "binaryAnnotations.value": "127.0.0.1" }}] } }}}],"must_not": {"exists": { "field": "parentId" } }}}, "size":400,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

?

6.去重查詢

{"query":{"bool":{"must":[ {"match":{"name":"query"}} ]}}, "aggs": {"traceId": {"terms": {"field": "traceId","size": 10 }}}, "size":10,"from":0,"sort":[{"timestamp":{"order":"desc","unmapped_type":"boolean"}}]}

去重要使用aggs 語句，和query查詢平級(jí)，這里的意思是獲取name=query 的記錄并且用traceId去重

轉(zhuǎn)載于:https://www.cnblogs.com/devilwind/p/7488434.html

總結(jié)

以上是生活随笔為你收集整理的elasticsearch 复杂查询小记的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。