kibana各类查询模式范例


GET _search { "query": { "match_all": {} } } GET /_cat/health?v GET /_cat/indices?v GET /_alias GET crash_index/_search GET /2019-06-18_crash_index/crash_info/_search POST /lagou/job/_bulk {"index":{"_index":"lagou","_type":"job","_id":"1"}} {"title":"haha","salary":"2"} {"index":{"_index":"lagou","_type":"job","_id":"2"}} {"title":"haha","salary":"100"} GET /lagou/job/_search POST /cars/transactions/_bulk { "index": {}} { "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" } { "index": {}} { "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" } { "index": {}} { "price" : 30000, "color" : "green", "make" : "ford", "sold" : "2014-05-18" } { "index": {}} { "price" : 15000, "color" : "blue", "make" : "toyota", "sold" : "2014-07-02" } { "index": {}} { "price" : 12000, "color" : "green", "make" : "toyota", "sold" : "2014-08-19" } { "index": {}} { "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" } { "index": {}} { "price" : 80000, "color" : "red", "make" : "bmw", "sold" : "2014-01-01" } { "index": {}} { "price" : 25000, "color" : "blue", "make" : "ford", "sold" : "2014-02-12" } GET /cars/transactions/_search PUT /cars/_mapping/transactions { "properties": { "color": { "type": "text", "fielddata": true } } } PUT /cars/_mapping/transactions { "properties": { "make": { "type": "text", "fielddata": true } } } GET /cars/transactions/_search { "aggs" : { "popular_colors":{ "terms": { "field": "color", "size": 10 } } } } GET /cars/transactions/_search { "size":0, "aggs" : { "popular_colors":{ "terms": { "field": "color", "size": 10 } } } } GET /cars/transactions/_search { "size":0, "aggs" :{ "popular_colors" : { "terms": { "field": "color", "size": 10 }, "aggs" : { "avg_price" :{ "avg":{ "field": "price" } } } } } } GET /cars/transactions/_search { "size":0, "aggs": { "color_popular": { "terms": { "field": "color", "size": 10 }, "aggs":{ "company":{ "terms": { "field": "make", "size": 10 } } } } } } GET cars/transactions/_search { "size":0, "aggs":{ "popular_color":{ "terms": { "field": "color", "size": 10 }, "aggs":{ "avg_price": { "avg":{ "field": "price" } }, "company":{ "terms":{ "field":"make" } } } } } } GET cars/transactions/_search { "size":0, "aggs":{ "popular_color":{ "terms": { "field": "color", "size": 10 }, "aggs":{ "avg_col_price": { "avg":{ "field":"price" } }, "company":{ "terms":{ "field":"make" }, "aggs":{ "avg_com_price": { "avg":{ "field": "price" } } } } } } } } GET /cars/transactions/_search { "size":0, "aggs":{ "price":{ "histogram":{ "field":"price", "interval":20000 }, "aggs":{ "revenue":{ "sum":{ "field":"price" } } } } } } GET /cars/transactions/_search { "size":0, "aggs":{ "price":{ "histogram":{ "field":"price", "interval":20000 }, "aggs":{ "revenue":{ "extended_stats":{ "field":"price" } } } } } } GET cars/transactions/_search { "size":0, "aggs": { "sales": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM-dd", "min_doc_count" : 0 } } } } GET cars/transactions/_search { "size":0, "aggs": { "sales": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM-dd", "min_doc_count" : 0, "offset": "1d" } } } } GET cars/transactions/_search { "size":0, "aggs": { "sales": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM", "min_doc_count" : 0 } } } } GET cars/transactions/_search { "size":0, "aggs": { "sales": { "date_histogram": { "field": "sold", "interval": "month", "format": "yyyy-MM-dd", "min_doc_count" : 0, "extended_bounds" : { "min" : "2014-01-01", "max" : "2014-12-31" } }, "aggs": { "per_make_sum": { "terms": { "field": "make", "size": 10 }, "aggs": { "sum_price": { "sum": { "field": "price" } } } }, "total_sum": { "sum": { "field": "price" } } } } } } GET /cars/transactions/_search { "query": { "match": { "make": "ford" } }, "aggs": { "colors": { "terms": { "field": "color", "size": 10 } } } } GET /cars/transactions/_search { "size":0, "query": { "match": { "make": "ford" } }, "aggs": { "recent_sales": { "filter": { "range":{ "sold": { "from":"now-100M" } } }, "aggs": { "average_price":{ "avg": { "field": "price" } } } } } }

  

-------------- 查询所有数据 -----------
GET _search
{
  "query": {
    "match_all": {}
  }
}


-------------- 查询健康状态 -----------
GET /_cat/health?v


-------------- 查询所有索引 -----------
       GET /_cat/indices?v


-------------- 创建索引 -----------
       PUT /test_index?pretty


-------------- 删除索引 -----------
       DELETE /test_index?pretty



******************************************************* 别名的操作 *******************************************************
-------------- 查看所有索引 -----------
GET /_alias

-------------- 给单个索引增加别名 -----------
      GET /new_index/_alias/new_index_alias
      介绍:为索引new_index定义别名new_index_alias


-------------- 给多个索引增加相同的别名 -----------
POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "new_index", "alias" : "new_index_alias" } },
        { "add" : { "index" : "new_index_2", "alias" : "new_index_alias" } }
    ]
}
或者:
POST /_aliases
{
  "actions": [
    {
      "add": {
        "indices": [ "new_index","new_index_2" ],
        "alias": "new_index_alias"
      }
    }
  ]
}


-------------- 给多个索引增加多个别名 -----------
POST /_aliases
{
    "actions" : [
        { "add":{ "index" : "new_index", "alias" : "new_index_alias" } },
        { "add":{ "index" : "new_index_2", "alias" : "new_index_alias_2" } }
    ]
}


-------------- 根据索引通配符创建别名 -----------
POST /_aliases
{
    	"actions" : [
        	{ "add" : { "index" : "new_index*", "alias" : "new_index_alias" } }
    	]
}


-------------- 索引别名查看 -----------
GET /new_index/_alias/*   
如:查看索引new_index有哪些别名


-------------- 查看多个索引别名查看 -----------
       GET /new_index,new_index_2/_alias/*


-------------- 使用通配符查看多个索引别名查看 -----------
       GET /new_index*/_alias/*


-------------- 确认别名是否存在 -----------
       HEAD /new_index/_alias/new_index_route_alias



-------------- 删除单个索引别名 -----------
       DELETE /new_index/_alias/new_index_alias


-------------- 删除多个索引别名 -----------
       DELETE /new_index,new_index_2/_alias/new_index_alias      #多个索引以英文逗号“,”分隔


-------------- 重命名别名 -----------
POST /_aliases
{
   	 "actions" : [
       	 { "remove" : { "index" : "new_index", "alias" : "new_index_alias" } },
       	 { "add" : { "index" : "new_index_2", "alias" : "new_index_alias" } }
   	 ]
}



   ******************************************************* 数据查询 *******************************************************

   -------------- 查询索引下所有数据 -----------
      GET /2019-06-18_crash_index/crash_info/_search


   -------------- 查询别名下所有数据 -----------
     GET /crash_index/_search




   ******************************************************* metric 查询 *******************************************************






   ******************************************************* 桶查询 *******************************************************
#桶查询,不需要返回具体数据,以filed进行分桶
GET /cars/transactions/_search
{
  "size":0,
  "aggs" : {
  "popular_colors":{
    "terms": {
      "field": "color",
      "size": 10
      }
    }
  }
}

  

原文地址:https://www.cnblogs.com/gxyandwmm/p/12125535.html