kibana常用聚合查询DSL语句记录
-------- GET winlogbeat-2017.11.*/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "should": [ { "term": { "action": { "value": "LIST" } } }, { "term": { "action": { "value": "RETR" } } }, { "term": { "action": { "value": "STOR" } } }, { "term": { "action": { "value": "DELE" } } } ], "minimum_number_should_match": 1, "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } } } GET winlogbeat-2017.11.*/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "terms": { "action": [ "RETR" ] } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } } } ------ GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "terms": { "action": [ "LIST", "DELE", "RETR", "STOR" ] } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } }, "size": 0, "aggs": { "ff": { "terms": { "field": "filedir", "size": 100 } } } } ------ GET winlogbeat-*/_search { "size": 0, "query" : { "bool" : { "must" : [ { "range" : { "@timestamp" : { "from" : 1511654400000, "to" : 1511740800000, "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } }, { "term" : { "Appname" : { "value" : "FTP", "boost" : 1.0 } } }, { "terms" : { "action" : [ "LIST", "STOR", "DELE", "RETR" ], "boost" : 1.0 } } ], "must_not" : [ { "match" : { "message" : { "query" : ".ok", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } }, { "term" : { "filedir" : { "value" : "-", "boost" : 1.0 } } }, { "match" : { "filedir" : { "query" : "/%{[filesub][1]}", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, "aggregations" : { "filedir_count" : { "terms" : { "field" : "filedir", "size" : 10, "shard_size" : -1, "min_doc_count" : 1, "shard_min_doc_count" : 0, "show_term_doc_count_error" : false, "order" : [ { "_count" : "desc" }, { "_term" : "asc" } ] } } }, "ext" : { } } --------- RPT_C001_20171125.txt GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search { "size": 0, "query" : { "bool" : { "must" : [ { "range" : { "@timestamp" : { "from" : "2017-11-26T00:00:00.000+08:00", "to" : "2017-11-26T23:59:59.000+08:00", "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } }, { "term" : { "Appname" : { "value" : "FTP", "boost" : 1.0 } } }, { "terms" : { "action" : [ "LIST", "STOR", "DELE", "RETR" ], "boost" : 1.0 } } ], "must_not" : [ { "match" : { "message" : { "query" : ".ok", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } }, { "term" : { "filedir" : { "value" : "-", "boost" : 1.0 } } }, { "match" : { "filedir" : { "query" : "/%{[filesub][1]}", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, "aggregations" : { "aggTop" : { "terms" : { "field" : "filedir", "size" : 50, "shard_size" : -1, "min_doc_count" : 1, "shard_min_doc_count" : 0, "show_term_doc_count_error" : false, "order" : [ { "_count" : "desc" }, { "_term" : "asc" } ] } } }, "ext" : { } } GET winlogbeat-2017.11.25,winlogbeat-2017.11.26/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "terms": { "action": [ "LIST", "DELE", "RETR", "STOR" ] } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } }, "size": 0, "aggs": { "ff": { "terms": { "field": "filedir", "size": 100 } } } } GET winlogbeat-2017.11.*/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "term": { "filedir": { "value": "/SJPT" } } }, { "terms": { "action": [ "LIST", "DELE", "RETR", "STOR" ] } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } } } ------ GET winlogbeat-2017.11.*/_search { "size": 0, "query" : { "bool" : { "must" : [ { "range" : { "@timestamp" : { "from" : "2017-11-26T00:00:00.000+08:00", "to" : "2017-11-26T23:59:59.000+08:00", "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } }, { "term" : { "Appname" : { "value" : "FTP", "boost" : 1.0 } } }, { "term" : { "action" : { "value" : "LIST", "boost" : 1.0 } } } ], "must_not" : [ { "match" : { "message" : { "query" : ".ok", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } }, { "term" : { "filedir" : { "value" : "-", "boost" : 1.0 } } }, { "match" : { "filedir" : { "query" : "/%{[filesub][1]}", "operator" : "OR", "prefix_length" : 0, "max_expansions" : 50, "fuzzy_transpositions" : true, "lenient" : false, "zero_terms_query" : "NONE", "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, "aggregations" : { "aggTop" : { "terms" : { "field" : "filedir", "size" : 50, "shard_size" : -1, "min_doc_count" : 1, "shard_min_doc_count" : 0, "show_term_doc_count_error" : false, "order" : [ { "_count" : "desc" }, { "_term" : "asc" } ] } }, "aggList" : { "terms" : { "field" : "account", "size" : 50, "shard_size" : -1, "min_doc_count" : 1, "shard_min_doc_count" : 0, "show_term_doc_count_error" : false, "order" : [ { "_count" : "desc" }, { "_term" : "asc" } ] } } }, "ext" : { } } GET winlogbeat-2017.11.*/_search { "query": { "bool": { "must": [ { "term": { "Appname": { "value": "FTP" } } }, { "term": { "account": { "value": "ICCCUAT\\uatjc06400" } } }, { "terms": { "action": [ "LIST" ] } }, { "range": { "@timestamp": { "gte": "2017-11-26T00:00:00.000+08:00", "lte": "2017-11-26T23:59:59.000+08:00" } } } ], "must_not": [ { "term": { "filedir": { "value": "/%{[filesub][1]}" } } },{ "term": { "filedir": { "value": "-" } } },{ "match": { "message": ".ok" } } ] } } }
kibana常用聚合查询DSL语句记录的更多相关文章
- ElasticSearch 常用的查询过滤语句
query 和 filter 的区别请看: http://www.cnblogs.com/ghj1976/p/5292740.html Filter DSL term 过滤 term主要用于精确匹配 ...
- [转] ElasticSearch 常用的查询过滤语句
备忘remark https://www.cnblogs.com/ghj1976/p/5293250.html query 和 filter 的区别请看: http://www.cnblogs.co ...
- 软件测试最常用的 SQL 命令 | 掌握基本查询、条件查询、聚合查询
1.DML核心CRUD增删改查 缩写全称和对应 SQL: * DML 数据操纵语言:Data Manipulation Language * Create 增加:insert * Retrieve 查 ...
- Mongoose中的关联表查询 && 聚合查询
注:阅读此篇文章,需要有一定的Mongo基础.基本的不会再重复介绍. 例: 有两张表,一张是博客列表,另外一张是博客的标签表.现在我们要做两张表的插入和关联查询. 创建两张表的Schema 主表bl ...
- {django模型层(二)多表操作}一 创建模型 二 添加表记录 三 基于对象的跨表查询 四 基于双下划线的跨表查询 五 聚合查询、分组查询、F查询和Q查询
Django基础五之django模型层(二)多表操作 本节目录 一 创建模型 二 添加表记录 三 基于对象的跨表查询 四 基于双下划线的跨表查询 五 聚合查询.分组查询.F查询和Q查询 六 xxx 七 ...
- 数据库基本查询语句(SQL常用增删改查语句 简单复习 mark)
SQL常用增删改查语句 1增 1.1[插入单行]insert [into] <表名> (列名) values (列值)例:insert into Strdents (姓名,性别,出生日期) ...
- orm分组,聚合查询,执行原生sql语句
from django.db.models import Avg from app01 import models annotate:(聚合查询) ret=models.Article.objects ...
- 微擎查询SQL语句常用
pdo_fetch:根据SQL语句,查询一条记录 array | boolean pdo_fetch($sql, $params = array()); // :uid 是参数的一个点位符,没有使用引 ...
- [转] 常用SQL查询语句
sunada 的原文地址 常用SQL查询语句 一.简单查询语句 1. 查看表结构 SQL>DESC emp; 2. 查询所有列 SQL>SELECT * FROM emp; 3. 查询指 ...
随机推荐
- j2e应用概述
过年也过完了,现在正式开始进入j2e的整理.现在开篇第一篇,整理一下j2e应用和开发环境.j2e应用提供的跨平台性,开放性已经各种远程访问的技术,为异构系统的良好整合提供了保证.注意这个是有一个异构系 ...
- grails项目中(DB的相关操作)
grails项目中(DB的相关操作) save:保存Domain对象的数据到对应的库表中(可能是insert也可能是update) findBy: 动态方法,查找并返回第一条记录,方法名可以变化 eg ...
- CSS——类和ID选择器的区别
1.相同点,可以应用在任何元素. 2.不同点,ID选择器只能在元素里只能分别引用,不能同时引用. 如: <style type="text/css">.stress{( ...
- C语言的格式符
转至:http://blog.csdn.net/zhanzheng520/article/details/10434791 一.格式符含义 1.d格式符:按十进制格式输出. %d ...
- aop难点解析。
静态织入和动态织入的区别? 需求示例:假设有一个包,一个包当中有一个方法,我们想在这个方法的前后,加上环绕. 那么怎么加呢? 把知道的都说一遍. 1.建立JsonService 2.建立JSONASP ...
- 给file_get_contents函数设置超时时间
$opts = array( 'http'=>array( 'method'=>"GET", 'timeout'=>60, ) ); $context = str ...
- Restful、Jersey和JAX-RS
一:MVC与SpringMVC MVC:是一种思想,是一种设计模式 SpringMVC:是一个框架,实现了MVC这种思想. 之前:写JSP页面,比较繁琐.eg:在页面显示用户列表,我们会在JSP页面 ...
- (转)Unity控制反转和依赖注入
昨天,面试官说他们的项目使用的是Unity,我们的项目中使用的是autofac,看了一下,用法都差不多,就连方法的名字都是一样的哈,想了解的朋友可以看看这篇文章,作者讲解的挺详细的,关于autofac ...
- 解决asp.net MVC中 当前上下文中不存在名称“model” 的问题
在vs2013下打开同事上传的cshtml视图文件报错,出现当前上下文中不存在名称“model”,ViewBag,Url等等,在视图中也没有智能提示了:但是不影响编译运行,只是开发时候比较麻烦,但在同 ...
- 小甲鱼OD学习第1讲
这一讲我们的目标是修改Hello.exe对话框的标题和内容,如图所示 把程序放进OD,按F8一步步运行,直到程序弹出对话框为止,然后在弹出对话框位置处下断点 按Ctrl+F2重新载入程序,然后按F9直 ...