如何使用ES做简单的时间条件过滤+模糊查询+精确匹配+关键字排除，查询 elasticsearch查询结果包含或排除某些字段、_source查询出需要的属性名称

这篇具有很好参考价值的文章主要介绍了如何使用ES做简单的时间条件过滤+模糊查询+精确匹配+关键字排除，查询 elasticsearch查询结果包含或排除某些字段、_source查询出需要的属性名称。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

一、时间条件过滤+模糊查询+精确匹配+关键字排除

1. 查询出包含 log_geo 的数据 “wildcard”: { “message”: “log_geo” }

2. 查询某个时间段的数据

3. 条件查询与条件排除数据

4. from 表示起始的记录的ID

5. size 表示显示的记录数

6.sort排序 desc降序、asc升序

7.should查询在mysql中就好比是or或

8. aggs:执行聚合

9.bool query布尔查询

二、_source查询结果包含或排除某些字段

一、时间条件过滤+模糊查询+精确匹配+关键字排除

1. 查询出包含 log_geo 的数据 “wildcard”: { “message”: “log_geo” }

log_geo 前面有*表示搜索以log_geo结尾的数据

log_geo后面有* 表示搜以log_geo开始的数据

log_geo前后都有*就是通用匹配包含log_geo的记录

“wildcard”:
{ 
   “message”: “log_geo” 
}

2. 查询某个时间段的数据

“range”: { 
    “@timestamp”: { 
        “gt”: “2018-02-08T07:00:00.056000000+00:00”,
        ”lt”: “2018-02-08T08:00:00.056000000+00:00” 
     } 
}

#注意时区减去8小时

3. 条件查询与条件排除数据

3.1 match 包含provider 的数据

{ 
“match”: 
    {
     “message”: “type:provider” 
    }
}

3.2 must_not 类似于 must 做排除使用

“must_not”: { 
    “match”: { 
        “message”: “dateTime:2018-02-08 15:59”
     }
}

4. from 表示起始的记录的ID

5. size 表示显示的记录数

6.sort排序 desc降序、asc升序

7.should查询在mysql中就好比是or或

但在es中使用should查询必须要和must一起使用才可以，相当于must[should A,should B],中文解释就好比是满足A或者是B条件的数据

8. aggs:执行聚合

9.bool query布尔查询

布尔查询是一个复合查询，由各个bool类型的子查询组成。

must ：返回文档必须满足该条件，且提供分数
filter ：返回文档必须满足该条件，但是不需要提供分数
should ：返回文档可以满足0个或多个条件，且提供分数
must_not : 返回文档必须不满足条件，但是不需要提供分数

查询语句 1，2，3可以组合，也可以单独使用，查询语句如果得不到想要的结果应该是ES的分词导致的，组合起来的语句如下：

{
  "query": {
    "bool": {
      "must": [
        { "range": { "@timestamp": { "gt": "2018-02-08T07:00:00.056000000+00:00","lt": "2018-02-08T08:00:00.056000000+00:00" } }  }
        ,   
        {  "wildcard": { "message": "*cp_geo*" }  }
        ,
        { "match": { "message": "*type:platform*" } }
      ],
      "must_not": { "match": { "message": "*deviceTypeCode:DTout00000000*" } },
      "should": []
    }
  },
  "from": 0,
  "size": 50,
  "sort": {  "@timestamp": "desc"  },
  "aggs": {}
}

参考原文地址：https://blog.51cto.com/u_8649447/4869008

二、_source查询结果包含或排除某些字段

通过_source 字段中的 include 和 exclude 来指定返回结果包含哪些字段，排除哪些字段
举例：根据关系单号，查询 es，设置_source 的 include 和 exclude

实例查询语句：

{
  "_source":{
    "include":[
      "policyNo",
      "policyRelationNo",
      "policyStatus"
    ],
    "exclude":[
       "salesType"
    ]
  },
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "policyRelationNo": "KR01435021"
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "from": 0,
  "size": 10
}

查询效果：文章来源地址https://www.toymoban.com/news/detail-802555.html

{
    "_shards": {
        "total": 5,
        "successful": 5,
        "failed": 0
    },
    "hits": {
        "total": 19,
        "max_score": 11.391884,
        "hits": [
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407038",
                "_score": 11.391884,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120319",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407046",
                "_score": 10.713255,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120323",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407044",
                "_score": 10.713255,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120322",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407066",
                "_score": 10.713255,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120333",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407058",
                "_score": 10.713255,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120329",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407070",
                "_score": 10.713255,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120335",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407056",
                "_score": 10.294733,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120328",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407052",
                "_score": 10.294733,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120326",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407062",
                "_score": 10.294733,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120331",
                    "policyStatus": 11
                }
            },
            {
                "_index": "search4policy-msad-dev3_20200520000000",
                "_type": "policy-msad-dev3",
                "_id": "4407064",
                "_score": 10.294733,
                "_source": {
                    "policyRelationNo": "KR01435021",
                    "policyNo": "B609120332",
                    "policyStatus": 11
                }
            }
        ]
    },
    "took": 5,
    "timed_out": false
}

到了这里，关于如何使用ES做简单的时间条件过滤+模糊查询+精确匹配+关键字排除，查询 elasticsearch查询结果包含或排除某些字段、_source查询出需要的属性名称的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！