当前位置：首页 > news >正文

elasticsearch基本操作笔记

news 来源：原创 2025/6/7 5:24:06

1.通过kibana查看elasticsearch版本信息
a.左上角三道横->Management->Dev Tools
b.GET / 执行
c.执行结果
{
“name” : “xxxx”,
“cluster_name” : “xxxxxxx”,
“cluster_uuid” : “vl1UudAoQp-aHWAzyPoMyw”,
“version” : {
“number” : “7.15.1”,
“build_flavor” : “default”,
“build_type” : “docker”,
“build_hash” : “83c34f456ae29d60e94d886e455e6a3409bba9ed”,
“build_date” : “2021-10-07T21:56:19.031608185Z”,
“build_snapshot” : false,
“lucene_version” : “8.9.0”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}

2.精确排除字符串查询

context:“xx” AND NOT location:“xxx” AND NOT location:“xxx” AND NOT location:“xxx”

3.elasticsearch分桶统计key为traceId的value相同个数大于1的所有key和count
GET /bff-prod*/_search
{
“size”: 0, // 不返回原始文档
“aggs”: {
“duplicate_traceids”: {
“terms”: {
“field”: “ext.traceId.keyword”, // 确保使用keyword类型字段
“min_doc_count”: 2, // 只返回出现2次以上的结果
“size”: 1000 // 覆盖所有重复项（按需调整）
}
}
}
}

4.按关键字统计个数
GET /bff-prod*/_search
{
“size”: 0,
“aggs”: {
“duplicate_traceids”: {
“terms”: {
“field”: “ext.traceId.keyword”,
“min_doc_count”: 2,
“size”: 1000
}
}
}
}

# 5.带认证的连接
es = Elasticsearch(
[‘https://10.126.141.98:9200’],
basic_auth=(“elastic”, “z7aJPPruXz9tk26r”),
verify_certs=False # 自签名证书需关闭验证:ml-citation{ref=“4” data=“citationList”}
)

5.elasticsearch查询昨天的数据，分桶统计traceId字段的值重复个数大于1的key和doc_count；
GET /bff-prod*/_search
{
“query”: {
“range”: {
“@timestamp”: {
“gte”: “now-1d/d”,
“lt”: “now/d”,
“time_zone”: “+08:00”
}
}
},
“aggs”: {
“duplicate_traces”: {
“terms”: {
“field”: “ext.traceId.keyword”,
“min_doc_count”: 2,
“size”: 10000
},
“aggs”: {
“bucket_filter”: {
“bucket_selector”: {
“buckets_path”: {
“docCount”: “_count”
},
“script”: “params.docCount > 1”
}
}
}
}
},
“size”: 0
}