1. 程式人生 > >elasticsearch條件查詢語句與聚合查詢語句模板

elasticsearch條件查詢語句與聚合查詢語句模板

欄位解釋:

條件查詢:

_source:表示需要展示的欄位

聚合查詢

field: 表示聚合的欄位

size 顯示條數

order 排序方法

1、條件查詢語句

{
  "_source": [
    "UUID",
    "workOrderData.appNo"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "workOrderData.appNo": [
              "2017060487300285"
            ]
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  },
  "size": 100
}

2、聚合查詢語句

例子1

{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "workOrderData.center": [
              "7110101",
              "7110102"
            ]
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  },
  "size": 0,
  "aggs": {
    "aggs_block": {
      "terms": {
        "field": "workOrderData.busiType"
      }
    }
  }
}

例子2

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "relateData.callTime": {
              "gte": "2016-07-26 00:00:00"
            }
          }
        },
        {
          "range": {
            "relateData.callTime": {
              "lte": "2017-08-02 23:59:59"
            }
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "1": {
      "terms": {
        "field": "analysisData.competitorList",
        "size": 10,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}

3、should欄位和must欄位一起使用

例子1(should和must同級使用)

{
  "_source": [
    "relateData.orderNum",
    "relateDate.businessType",
    "relateData.agentGroupName",
    "relateData.agentDepartmentName",
    "relateData.acceptTime",
    "analysisData.is_rule_complain"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "relateData.callTime": {
              "gte": "2017-02-22 00:00:00",
              "lte": "2017-08-16 23:59:59"
            }
          }
        }
      ],
      "should": [
        {
          "term": {
            "transData.emotionList.emtionType": {
              "value": "2"
            }
          }
        },
        {
          "term": {
            "analysisData.is_rule_complain": {
              "value": "是"
            }
          }
        }
      ]
    }
  },
  "sort": {
    "relateData.acceptTime": {
      "order": "desc"
    }
  },
  "from": 0,
  "size": 10
}

在這裡should裡面的條件滿足一條就可以。相當於or

但是當should與must一起使用時候就失去了should的意義 因為只要滿足must的條件就可以

例子2(should為must的上一級)

當我們有and 和 or 並列的查詢要求時,(a==0 && b== 0 && (c==0 || d== 0))

我們可以使用如下的elasticsearch查詢語句

在should裡面包含bool

{
  "_source": [
    "relateData.orderNum",
    "relateDate.businessType",
    "relateData.agentGroupName",
    "relateData.agentDepartmentName",
    "relateData.acceptTime",
    "analysisData.is_rule_complain"
  ],
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "range": {
                  "relateData.callTime": {
                    "gte": "2017-02-22 00:00:00",
                    "lte": "2017-08-16 23:59:59"
                  }
                }
              },
              {
                "term": {
                  "transData.emotionList.emtionType": {
                    "value": "2"
                  }
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "range": {
                  "relateData.callTime": {
                    "gte": "2017-02-22 00:00:00",
                    "lte": "2017-08-16 23:59:59"
                  }
                }
              },
              {
                "term": {
                  "analysisData.is_rule_complain": {
                    "value": "是"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}

4、aggs巢狀聚合語句

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "relateData.callTime": {
              "gte": "2017-08-30 00:00:00"
            }
          }
        },
        {
          "range": {
            "relateData.callTime": {
              "lte": "2017-09-06 23:59:59"
            }
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "1": {
      "terms": {
        "field": "relateData.businessType",
        "size": 15,
        "order": {
          "_count": "desc"
        }
      },
      "aggs": {
        "2": {
          "terms": {
            "field": "qualityData.ATTENTION_WORD.keyWord.keyword",
            "order": {
              "_count": "desc"
            }
          },
          "aggs": {
            "3": {
              "terms": {
                "field": "relateData.customerPhoneNo",
                "size": 2147483647,
                "min_doc_count": 2
              }
            }
          }
        }
      }
    }
  }
}
查詢部分結果展示:
"hits": {
    "total": 190,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "1": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "2": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "3": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "13554186343",
                      "doc_count": 2
                    },
                    {
                      "key": "13554186390",
                      "doc_count": 2
                    },
                    {
                      "key": "13554186399",
                      "doc_count": 2
                    }
                  ]
                },
                "key": "減肥",
                "doc_count": 8
              },
              {
                "3": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "13554186356",
                      "doc_count": 2
                    },
                    {
                      "key": "13554186389",
                      "doc_count": 2
                    }
                  ]
                },
                "key": "是個",
                "doc_count": 7
              },
              {
                "3": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "13554186389",
                      "doc_count": 2
                    }
                  ]
                },
                "key": "綠瘦",
                "doc_count": 4
              }
            ]
          },
          "key": "故障",
          "doc_count": 187
        }
查詢的結果為:首先聚合業務型別,然後聚合業務關注詞,最後聚合電話號,聚合結果的意義為在指定業務型別下的指定的業務關注詞下的重複來電電話與個數。

5、interval關鍵字的使用
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "relateData.callTime": {
              "gte": "2017-08-30 00:00:00"
            }
          }
        },
        {
          "range": {
            "relateData.callTime": {
              "lte": "2017-09-06 23:59:59"
            }
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "1": {
      "terms": {
        "field": "qualityData.ATTENTION_WORD.keyWord.keyword",
        "size": 10,
        "order": {
          "_count": "desc"
        }
      },
      "aggs": {
        "2": {
          "date_histogram": {
            "field": "relateData.callTime",
            "interval": "1d",
            "extended_bounds": {
              "min": "2017-08-30 00:00:00",
              "max": "2017-09-06 23:59:59"
            }
          }
        }
      }
    }
  }
}
結果展示:
"aggregations": {
    "1": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "2": {
            "buckets": [
              {
                "key_as_string": "2017-08-30 00:00:00",
                "key": 1504051200000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-08-31 00:00:00",
                "key": 1504137600000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-01 00:00:00",
                "key": 1504224000000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-02 00:00:00",
                "key": 1504310400000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-03 00:00:00",
                "key": 1504396800000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-04 00:00:00",
                "key": 1504483200000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-05 00:00:00",
                "key": 1504569600000,
                "doc_count": 0
              },
              {
                "key_as_string": "2017-09-06 00:00:00",
                "key": 1504656000000,
                "doc_count": 8
              }
            ]
          },
          "key": "減肥",
          "doc_count": 8
        }
interval關鍵字使得在聚合callTime欄位的時候是按照1天的間隔進行聚合,這對於資料統計過長時間範圍內能夠更加智慧的查詢,不會導致橫座標過於密。

extended_bounds欄位表示強制的將資料顯示在指定的時間範圍,防止查詢的結果超出預期範圍。

6、正則表示式

"query": {
        "regexp":{
            "name.first": "s.*y"
        }
    }