elasticsearch條件查詢語句與聚合查詢語句模板
阿新 • • 發佈:2019-02-13
欄位解釋:
條件查詢:
_source:表示需要展示的欄位
聚合查詢
field: 表示聚合的欄位
size 顯示條數
order 排序方法
1、條件查詢語句
{
"_source": [
"UUID",
"workOrderData.appNo"
],
"query": {
"bool": {
"must": [
{
"terms": {
"workOrderData.appNo": [
"2017060487300285"
]
}
}
],
"must_not": [],
"should": []
}
},
"size": 100
}
2、聚合查詢語句
例子1
{
"query": {
"bool": {
"must": [
{
"terms": {
"workOrderData.center": [
"7110101",
"7110102"
]
}
}
],
"must_not": [],
"should": []
}
},
"size": 0,
"aggs": {
"aggs_block": {
"terms": {
"field": "workOrderData.busiType"
}
}
}
}
例子2
{ "query": { "bool": { "must": [ { "range": { "relateData.callTime": { "gte": "2016-07-26 00:00:00" } } }, { "range": { "relateData.callTime": { "lte": "2017-08-02 23:59:59" } } } ] } }, "size": 0, "aggs": { "1": { "terms": { "field": "analysisData.competitorList", "size": 10, "order": { "_count": "desc" } } } } }
3、should欄位和must欄位一起使用
例子1(should和must同級使用)
{
"_source": [
"relateData.orderNum",
"relateDate.businessType",
"relateData.agentGroupName",
"relateData.agentDepartmentName",
"relateData.acceptTime",
"analysisData.is_rule_complain"
],
"query": {
"bool": {
"must": [
{
"range": {
"relateData.callTime": {
"gte": "2017-02-22 00:00:00",
"lte": "2017-08-16 23:59:59"
}
}
}
],
"should": [
{
"term": {
"transData.emotionList.emtionType": {
"value": "2"
}
}
},
{
"term": {
"analysisData.is_rule_complain": {
"value": "是"
}
}
}
]
}
},
"sort": {
"relateData.acceptTime": {
"order": "desc"
}
},
"from": 0,
"size": 10
}
在這裡should裡面的條件滿足一條就可以。相當於or
但是當should與must一起使用時候就失去了should的意義 因為只要滿足must的條件就可以
例子2(should為must的上一級)
當我們有and 和 or 並列的查詢要求時,(a==0 && b== 0 && (c==0 || d== 0))
我們可以使用如下的elasticsearch查詢語句
在should裡面包含bool
{
"_source": [
"relateData.orderNum",
"relateDate.businessType",
"relateData.agentGroupName",
"relateData.agentDepartmentName",
"relateData.acceptTime",
"analysisData.is_rule_complain"
],
"query": {
"bool": {
"should": [
{
"bool": {
"must": [
{
"range": {
"relateData.callTime": {
"gte": "2017-02-22 00:00:00",
"lte": "2017-08-16 23:59:59"
}
}
},
{
"term": {
"transData.emotionList.emtionType": {
"value": "2"
}
}
}
]
}
},
{
"bool": {
"must": [
{
"range": {
"relateData.callTime": {
"gte": "2017-02-22 00:00:00",
"lte": "2017-08-16 23:59:59"
}
}
},
{
"term": {
"analysisData.is_rule_complain": {
"value": "是"
}
}
}
]
}
}
]
}
}
}
4、aggs巢狀聚合語句
{
"query": {
"bool": {
"must": [
{
"range": {
"relateData.callTime": {
"gte": "2017-08-30 00:00:00"
}
}
},
{
"range": {
"relateData.callTime": {
"lte": "2017-09-06 23:59:59"
}
}
}
]
}
},
"size": 0,
"aggs": {
"1": {
"terms": {
"field": "relateData.businessType",
"size": 15,
"order": {
"_count": "desc"
}
},
"aggs": {
"2": {
"terms": {
"field": "qualityData.ATTENTION_WORD.keyWord.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"3": {
"terms": {
"field": "relateData.customerPhoneNo",
"size": 2147483647,
"min_doc_count": 2
}
}
}
}
}
}
}
}
查詢部分結果展示:
"hits": {
"total": 190,
"max_score": 0,
"hits": []
},
"aggregations": {
"1": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "13554186343",
"doc_count": 2
},
{
"key": "13554186390",
"doc_count": 2
},
{
"key": "13554186399",
"doc_count": 2
}
]
},
"key": "減肥",
"doc_count": 8
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "13554186356",
"doc_count": 2
},
{
"key": "13554186389",
"doc_count": 2
}
]
},
"key": "是個",
"doc_count": 7
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "13554186389",
"doc_count": 2
}
]
},
"key": "綠瘦",
"doc_count": 4
}
]
},
"key": "故障",
"doc_count": 187
}
查詢的結果為:首先聚合業務型別,然後聚合業務關注詞,最後聚合電話號,聚合結果的意義為在指定業務型別下的指定的業務關注詞下的重複來電電話與個數。5、interval關鍵字的使用
{
"query": {
"bool": {
"must": [
{
"range": {
"relateData.callTime": {
"gte": "2017-08-30 00:00:00"
}
}
},
{
"range": {
"relateData.callTime": {
"lte": "2017-09-06 23:59:59"
}
}
}
]
}
},
"size": 0,
"aggs": {
"1": {
"terms": {
"field": "qualityData.ATTENTION_WORD.keyWord.keyword",
"size": 10,
"order": {
"_count": "desc"
}
},
"aggs": {
"2": {
"date_histogram": {
"field": "relateData.callTime",
"interval": "1d",
"extended_bounds": {
"min": "2017-08-30 00:00:00",
"max": "2017-09-06 23:59:59"
}
}
}
}
}
}
}
結果展示:
"aggregations": {
"1": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"2": {
"buckets": [
{
"key_as_string": "2017-08-30 00:00:00",
"key": 1504051200000,
"doc_count": 0
},
{
"key_as_string": "2017-08-31 00:00:00",
"key": 1504137600000,
"doc_count": 0
},
{
"key_as_string": "2017-09-01 00:00:00",
"key": 1504224000000,
"doc_count": 0
},
{
"key_as_string": "2017-09-02 00:00:00",
"key": 1504310400000,
"doc_count": 0
},
{
"key_as_string": "2017-09-03 00:00:00",
"key": 1504396800000,
"doc_count": 0
},
{
"key_as_string": "2017-09-04 00:00:00",
"key": 1504483200000,
"doc_count": 0
},
{
"key_as_string": "2017-09-05 00:00:00",
"key": 1504569600000,
"doc_count": 0
},
{
"key_as_string": "2017-09-06 00:00:00",
"key": 1504656000000,
"doc_count": 8
}
]
},
"key": "減肥",
"doc_count": 8
}
interval關鍵字使得在聚合callTime欄位的時候是按照1天的間隔進行聚合,這對於資料統計過長時間範圍內能夠更加智慧的查詢,不會導致橫座標過於密。
extended_bounds欄位表示強制的將資料顯示在指定的時間範圍,防止查詢的結果超出預期範圍。
6、正則表示式
"query": {
"regexp":{
"name.first": "s.*y"
}
}