es常用查询语句

查询最近7天的数据量

curl -XGET 'http://user:password@ip:9200/access.log/_count' -H 'Content-Type: application/json' -d '
{ "query": { "range": { "@timestamp": { "gte": "now-7d/d", "lte": "now/d" } } } }'

查询最新的一条数据

curl -X GET "http://user:password@ip:9200/access.log/_search?pretty=true" -H 'Content-Type: application/json' -d'
{ "query": { "match_all": {} }, "sort": [ {"@timestamp": { "order": "desc" } } ], "size": 1}'

获取所有index

curl -X GET  http://elastic:elastic@127.0.0.1:9200/_cat/indices/a*?v

创建名为testtt别名

curl -X POST "http://elastic:elastic@127.0.0.1:9200/_aliases" -H 'Content-Type: application/json' -d '
{
"actions": [
{ "add": { "index": "a_test_info", "alias": "testtt" } },
{ "add": { "index": "a_test1_info", "alias": "testtt" } },
{ "add": { "index": "a_test_data", "alias": "testtt" } },
]
}'

知道需要查询的字段不知道具体内容，模糊查询

curl -X GET "http://elastic:elastic@127.0.0.1:9200/testtt/_search" -H 'Content-Type: application/json' -d '
{
"query": {
"match": {
  "contract_status": "待定"
}
}
}'

查询别名，模糊查询只知道要查什么

curl -X GET "http://elastic:elastic@127.0.0.1:9200/testtt/_search" -H 'Content-Type: application/json' -d '
{
"query": {
"multi_match": {
  "query": "80000",
  "fields": ["*"]
}
}
}'

查询index类型

curl -X GET "http://elastic:elastic@127.0.0.1:9200/tmp_test1/_mapping" -H 'Content-Type: application/json'

查询指定index中的数据量

curl http://elastic:elastic@127.0.0.1:9200/tmp_test1/_count?pretty

查询最近七天的数据

curl -XGET 'http://elastic:elastic@127.0.0.1:9200/tmp_test1/_count' -H 'Content-Type: application/json' -d '
{ "query": { "range": { "@timestamp": { "gte": "now-7d/d", "lte": "now/d" } } } }'

删除指定的index

curl -X DELETE "http://elastic:elastic@192.168.90.60:9200/tmp_test1"