=Start=

缘由：

最近用ElasticSearch的搜索比较多，但是比较麻烦的一点在于Web UI上的搜索如果匹配数量超过了10000就无法知道具体数量了，而且只支持简单的查询。基于这两个痛点，不得不转向去用ES搜索接口进行查询、检索。

初次使用，碰到了不少问题，在这里简单整理一下，方便以后快速参考。

正文：

参考解答：

## 查询 age 字段在 [10,20] 区间的信息
curl -X GET "localhost:9200/_search" -H 'Content-Type: application/json' -d'
{
    "query": {
        "range" : {
            "age" : {
                "gte" : 10,
                "lte" : 20,
                "boost" : 2.0
            }
        }
    }
}
'

&

## 查询 timestamp 字段在 [2015-01-01 00:00:00, now] 区间的信息（有时候需要在 00:00:00 后面添加一个'Z'字符）
curl -X GET "localhost:9200/_search" -H 'Content-Type: application/json' -d'
{
    "query": {
        "range" : {
            "timestamp" : {
                "gte": "2015-01-01 00:00:00", 
                "lte": "now", 
                "time_zone": "+08:00"
            }
        }
    }
}
'

&

## 查询 name.first 字段的内容是 "s.*y" 的信息
curl -X GET "localhost:9200/_search" -H 'Content-Type: application/json' -d'
{
    "query": {
        "regexp":{
            "name.first": "s.*y"
        }
    }
}
'

&

## must必须匹配 / filter限定条件
curl -X POST "localhost:9200/_search" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool" : {
      "must" : {
        "term" : { "user" : "kimchy" }
      },
      "filter": {
        "term" : { "tag" : "tech" }
      },
      "must_not" : {
        "range" : {
          "age" : { "gte" : 10, "lte" : 20 }
        }
      },
      "should" : [
        { "term" : { "tag" : "wow" } },
        { "term" : { "tag" : "elasticsearch" } }
      ],
      "minimum_should_match" : 1,
      "boost" : 1.0
    }
  }
}
'

&

#!/usr/bin/env python
# coding=utf-8

import sys, time
import json
import requests

def main():
    url = 'http://localhost:9200/index_name/_search'

    # 查找某个字段是否完全等于某个字符串的值
    # payload = {
    #     "query": {
    #         "query_string": {
    #            # "fields" : ["uniqueCode", ],
    #            # "query": "98xTyz-x8B7-4B79-82x6-xyz68D75"
    #            "query": "uniqueCode:\"98xTyz-x8B7-4B79-82x6-xyz68D75\"" #感觉这一行比上面两行的速度更快
    #            # "query": "\"search_string\""
    #         }
    #     }
    # }

    # 限定检索区间
    # payload = {
    #     "query": {
    #         "bool" : {
    #             "must": {
    #                 "term": { "uniqueCode": "98xTyz-x8B7-4B79-82x6-xyz68D75" }
    #             },
    #             "filter": {
    #                 "range" : {
    #                     "mt_datetime" : {
    #                         "gte": "2018-08-16 15:00:16Z",
    #                         "lte": "now",
    #                         "time_zone": "+08:00"
    #                     }
    #                 }
    #             }
    #         }
    #     }
    # }

    # 正则匹配
    payload = {
        "query": {
            "bool" : {
                "must": {
                    # "term": { "data": "\"search_string\"" },
                    "regexp":{
                        "data": ".*\"search_string\".*"
                    }
                },
                "filter": {
                    "range" : {
                        "mt_datetime" : {
                            "gte": "2018-08-16 00:00:00Z",
                            "lte": "2018-08-17 00:00:00Z",
                            # "lte": "now",
                            "time_zone": "+08:00"
                        }
                    }
                }
            }
        }
    }

    r = requests.post(url, data=json.dumps(payload))
    print r.text

if __name__ == '__main__':
    time_start = time.time()
    try:
        main()
    except KeyboardInterrupt:
        print 'Killed by user'
        sys.exit(0)
    print "Spend {0} seconds.\n".format(time.time() - time_start)

 

参考链接：

• 范围查询
  https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html
• Regexp Query(正则表达式查询)
  https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html
• Bool 查询
  https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html
• Elasticsearch查询——布尔查询Bool Query
• Elasticsearch（四）elasticsearch复杂检索
• elasticsearch 查询（match和term）
• Elasticsearch-bool组合查询

=END=