--------
GET winlogbeat-2017.11.*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "should": [
        {
          "term": {
            "action": {
              "value": "LIST"
            }
          }
        },
        {
          "term": {
            "action": {
              "value": "RETR"
            }
          }
        },
        {
          "term": {
            "action": {
              "value": "STOR"
            }
          }
        },
        {
          "term": {
            "action": {
              "value": "DELE"
            }
          }
        }
      ],
      "minimum_number_should_match": 1,
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  }
}

GET winlogbeat-2017.11.*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "terms": {
            "action": [
              "RETR"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  }
}
------
GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "terms": {
            "action": [
              "LIST",
              "DELE",
              "RETR",
              "STOR"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "ff": {
      "terms": {
        "field": "filedir",
        "size": 100
      }
    }
  }
}
------
GET winlogbeat-*/_search
{
  "size": 0,
  "query" : {
    "bool" : {
      "must" : [
        {
          "range" : {
            "@timestamp" : {
              "from" : 1511654400000,
              "to" : 1511740800000,
              "include_lower" : true,
              "include_upper" : true,
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "Appname" : {
              "value" : "FTP",
              "boost" : 1.0
            }
          }
        },
        {
          "terms" : {
            "action" : [
              "LIST",
              "STOR",
              "DELE",
              "RETR"
            ],
            "boost" : 1.0
          }
        }
      ],
      "must_not" : [
        {
          "match" : {
            "message" : {
              "query" : ".ok",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "filedir" : {
              "value" : "-",
              "boost" : 1.0
            }
          }
        },
        {
          "match" : {
            "filedir" : {
              "query" : "/%{[filesub][1]}",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggregations" : {
    "filedir_count" : {
      "terms" : {
        "field" : "filedir",
        "size" : 10,
        "shard_size" : -1,
        "min_doc_count" : 1,
        "shard_min_doc_count" : 0,
        "show_term_doc_count_error" : false,
        "order" : [
          {
            "_count" : "desc"
          },
          {
            "_term" : "asc"
          }
        ]
      }
    }
  },
  "ext" : { }
}
---------
RPT_C001_20171125.txt

GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search
{
  "size": 0,
  "query" : {
    "bool" : {
      "must" : [
        {
          "range" : {
            "@timestamp" : {
              "from" : "2017-11-26T00:00:00.000+08:00",
              "to" : "2017-11-26T23:59:59.000+08:00",
              "include_lower" : true,
              "include_upper" : true,
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "Appname" : {
              "value" : "FTP",
              "boost" : 1.0
            }
          }
        },
        {
          "terms" : {
            "action" : [
              "LIST",
              "STOR",
              "DELE",
              "RETR"
            ],
            "boost" : 1.0
          }
        }
      ],
      "must_not" : [
        {
          "match" : {
            "message" : {
              "query" : ".ok",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "filedir" : {
              "value" : "-",
              "boost" : 1.0
            }
          }
        },
        {
          "match" : {
            "filedir" : {
              "query" : "/%{[filesub][1]}",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggregations" : {
    "aggTop" : {
      "terms" : {
        "field" : "filedir",
        "size" : 50,
        "shard_size" : -1,
        "min_doc_count" : 1,
        "shard_min_doc_count" : 0,
        "show_term_doc_count_error" : false,
        "order" : [
          {
            "_count" : "desc"
          },
          {
            "_term" : "asc"
          }
        ]
      }
    }
  },
  "ext" : { }
}

GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "terms": {
            "action": [
              "LIST",
              "DELE",
              "RETR",
              "STOR"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  },
  "size": 0,
  "aggs": {
    "ff": {
      "terms": {
        "field": "filedir",
        "size": 100
      }
    }
  }
}

GET winlogbeat-2017.11.*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "term": {
            "filedir": {
              "value": "/SJPT"
            }
          }
        },
        {
          "terms": {
            "action": [
              "LIST",
              "DELE",
              "RETR",
              "STOR"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  }
}
------

GET winlogbeat-2017.11.*/_search
{
  "size": 0,
  "query" : {
    "bool" : {
      "must" : [
        {
          "range" : {
            "@timestamp" : {
              "from" : "2017-11-26T00:00:00.000+08:00",
              "to" : "2017-11-26T23:59:59.000+08:00",
              "include_lower" : true,
              "include_upper" : true,
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "Appname" : {
              "value" : "FTP",
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "action" : {
              "value" : "LIST",
              "boost" : 1.0
            }
          }
        }
      ],
      "must_not" : [
        {
          "match" : {
            "message" : {
              "query" : ".ok",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        },
        {
          "term" : {
            "filedir" : {
              "value" : "-",
              "boost" : 1.0
            }
          }
        },
        {
          "match" : {
            "filedir" : {
              "query" : "/%{[filesub][1]}",
              "operator" : "OR",
              "prefix_length" : 0,
              "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 1.0
            }
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggregations" : {
    "aggTop" : {
      "terms" : {
        "field" : "filedir",
        "size" : 50,
        "shard_size" : -1,
        "min_doc_count" : 1,
        "shard_min_doc_count" : 0,
        "show_term_doc_count_error" : false,
        "order" : [
          {
            "_count" : "desc"
          },
          {
            "_term" : "asc"
          }
        ]
      }
    },
    "aggList" : {
      "terms" : {
        "field" : "account",
        "size" : 50,
        "shard_size" : -1,
        "min_doc_count" : 1,
        "shard_min_doc_count" : 0,
        "show_term_doc_count_error" : false,
        "order" : [
          {
            "_count" : "desc"
          },
          {
            "_term" : "asc"
          }
        ]
      }
    }
  },
  "ext" : { }
}

GET winlogbeat-2017.11.*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "Appname": {
              "value": "FTP"
            }
          }
        },
        {
          "term": {
            "account": {
              "value": "ICCCUAT\\uatjc06400"
            }
          }
        },
        {
          "terms": {
            "action": [
              "LIST"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-11-26T00:00:00.000+08:00",
              "lte": "2017-11-26T23:59:59.000+08:00"
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "filedir": {
              "value": "/%{[filesub][1]}"
            }
          }
        },{
          "term": {
            "filedir": {
              "value": "-"
            }
          }
        },{
          "match": {
            "message": ".ok"
          }
        }
      ]
    }
  }
}

  

kibana常用聚合查询DSL语句记录的更多相关文章

  1. ElasticSearch 常用的查询过滤语句

    query 和  filter 的区别请看: http://www.cnblogs.com/ghj1976/p/5292740.html Filter DSL term 过滤 term主要用于精确匹配 ...

  2. [转] ElasticSearch 常用的查询过滤语句

    备忘remark https://www.cnblogs.com/ghj1976/p/5293250.html query 和  filter 的区别请看: http://www.cnblogs.co ...

  3. 软件测试最常用的 SQL 命令 | 掌握基本查询、条件查询、聚合查询

    1.DML核心CRUD增删改查 缩写全称和对应 SQL: * DML 数据操纵语言:Data Manipulation Language * Create 增加:insert * Retrieve 查 ...

  4. Mongoose中的关联表查询 && 聚合查询

    注:阅读此篇文章,需要有一定的Mongo基础.基本的不会再重复介绍. 例:  有两张表,一张是博客列表,另外一张是博客的标签表.现在我们要做两张表的插入和关联查询. 创建两张表的Schema 主表bl ...

  5. {django模型层(二)多表操作}一 创建模型 二 添加表记录 三 基于对象的跨表查询 四 基于双下划线的跨表查询 五 聚合查询、分组查询、F查询和Q查询

    Django基础五之django模型层(二)多表操作 本节目录 一 创建模型 二 添加表记录 三 基于对象的跨表查询 四 基于双下划线的跨表查询 五 聚合查询.分组查询.F查询和Q查询 六 xxx 七 ...

  6. 数据库基本查询语句(SQL常用增删改查语句 简单复习 mark)

    SQL常用增删改查语句 1增 1.1[插入单行]insert [into] <表名> (列名) values (列值)例:insert into Strdents (姓名,性别,出生日期) ...

  7. orm分组,聚合查询,执行原生sql语句

    from django.db.models import Avg from app01 import models annotate:(聚合查询) ret=models.Article.objects ...

  8. 微擎查询SQL语句常用

    pdo_fetch:根据SQL语句,查询一条记录 array | boolean pdo_fetch($sql, $params = array()); // :uid 是参数的一个点位符,没有使用引 ...

  9. [转] 常用SQL查询语句

    sunada  的原文地址 常用SQL查询语句 一.简单查询语句 1. 查看表结构 SQL>DESC emp; 2. 查询所有列 SQL>SELECT * FROM emp; 3. 查询指 ...

随机推荐

  1. selenium-java web自动化测试工具

    本篇文章由来,这两天整理了下自己经常使用而且很熟练的项目,今天突然想起漏了一个,补上了,但想到还没对应的博客,那就写一个简单的 我经常使用且相对熟练的部分技术如下(不知道算不算各位大神眼中的辣鸡): ...

  2. Rhel-Server 5.5 安装ORACLE10

    VMWARE + REDHAT + ORA10 先说一下环境,操作系统为Microsoft Windows Server 2003,安装的是虚拟机VMware Workstation Version ...

  3. ulua c#调用lua中模拟的类成员函数

    项目使用ulua,我神烦这个东西.lua单纯在lua环境使用还好,一旦要跟外界交互,各种月经不调就来了.要记住贼多的细节,你才能稍微处理好.一个破栈,pop来push去,位置一会在-1,一会在-3,2 ...

  4. BSGS(Baby Steps,Giant Steps)算法详解

    BSGS(Baby Steps,Giant Steps)算法详解 简介: 此算法用于求解 Ax≡B(mod C): 由费马小定理可知: x可以在O(C)的时间内求解:  在x=c之后又会循环: 而BS ...

  5. 模型的继承 -- Django从入门到精通系列教程

    该系列教程系个人原创,并完整发布在个人官网刘江的博客和教程 所有转载本文者,需在顶部显著位置注明原作者及www.liujiangblog.com官网地址. Python及Django学习QQ群:453 ...

  6. CSS核心内容之浮动

    1.浮动涉及到左浮动,右浮动,清除浮动. 2.浮点的特点: 1.向指定的方向浮动,并且让出空间 2.如果后面的元素也是浮动的,那么后面的元素就会在碰到前面的浮动的元素或者边框时,就定位在那里 3.如果 ...

  7. c#写的热键注册程序

    玩网页游戏挂机,又不想让别人看见你电脑的运行.所以写了个后台运行的程序. 先谁HotKey注册类,用来调用com组件来显示与隐藏窗体: using System; using System.Colle ...

  8. BZOJ 3091: 城市旅行 [LCT splay 期望]

    3091: 城市旅行 Time Limit: 10 Sec  Memory Limit: 128 MBSubmit: 1454  Solved: 483[Submit][Status][Discuss ...

  9. C#开发短信发送

    //需要用到的命名空间 using System.Net;using System.IO;using System.Text;//调用时只需要把拼成的URL传给该函数即可.判断返回值即可public ...

  10. 将你的Python Web程序部署到Ubuntu服务器上

    在本文记录了我在Ubuntu中部署Flask Web站点的过程, 其中包括用户创建.代码获取.Python3环境的安装.虚拟环境设置.uWSGI启动程序设置,并将Nginx作为前端反向代理.希望对各位 ...