kibana各类查询模式范例

GET _search
{
  "query": {
    "match_all": {}
  }
}

GET /_cat/health?v

GET /_cat/indices?v

GET /_alias

GET crash_index/_search

GET /2019-06-18_crash_index/crash_info/_search



POST /lagou/job/_bulk
{"index":{"_index":"lagou","_type":"job","_id":"1"}}
{"title":"haha","salary":"2"}
{"index":{"_index":"lagou","_type":"job","_id":"2"}}
{"title":"haha","salary":"100"}

GET /lagou/job/_search


POST /cars/transactions/_bulk
{ "index": {}}
{ "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 30000, "color" : "green", "make" : "ford", "sold" : "2014-05-18" }
{ "index": {}}
{ "price" : 15000, "color" : "blue", "make" : "toyota", "sold" : "2014-07-02" }
{ "index": {}}
{ "price" : 12000, "color" : "green", "make" : "toyota", "sold" : "2014-08-19" }
{ "index": {}}
{ "price" : 20000, "color" : "red", "make" : "honda", "sold" : "2014-11-05" }
{ "index": {}}
{ "price" : 80000, "color" : "red", "make" : "bmw", "sold" : "2014-01-01" }
{ "index": {}}
{ "price" : 25000, "color" : "blue", "make" : "ford", "sold" : "2014-02-12" }

GET /cars/transactions/_search


PUT /cars/_mapping/transactions
{       
   "properties": {
         "color": {  
             "type": "text",
             "fielddata": true
         }       
     }         
}

PUT /cars/_mapping/transactions
{       
   "properties": {
         "make": {  
             "type": "text",
             "fielddata": true
         }       
     }         
}



GET /cars/transactions/_search
{
  "aggs" : {
  "popular_colors":{
    "terms": {
      "field": "color",
      "size": 10
      }
    }
  }
}


GET /cars/transactions/_search
{
  "size":0,
  "aggs" : {
  "popular_colors":{
    "terms": {
      "field": "color",
      "size": 10
      }
    }
  }
}


GET /cars/transactions/_search
{
  "size":0,
  "aggs" :{
    "popular_colors" : {
      "terms": {
        "field": "color",
        "size": 10
      },
    "aggs" : {
      "avg_price" :{
        "avg":{
          "field": "price"
          }
        }
      }
    }
  }
}

GET /cars/transactions/_search
{
  "size":0,
  "aggs": {
    "color_popular": {
      "terms": {
        "field": "color",
        "size": 10
      },
      
      "aggs":{
       "company":{
         "terms": {
           "field": "make",
           "size": 10
         }
        }
      } 
    }
  }
}


GET cars/transactions/_search
{
  "size":0,
  "aggs":{
   "popular_color":{
     "terms": {
       "field": "color",
       "size": 10
     },
     "aggs":{
       "avg_price": {
         "avg":{
           "field": "price"
         }
       },
       
     "company":{
       "terms":{
         "field":"make"
          }
        }
      }
    }
  }
}

GET cars/transactions/_search
{
  "size":0,
  "aggs":{
   "popular_color":{
     "terms": {
       "field": "color",
       "size": 10
     },
     "aggs":{
       "avg_col_price": {
         "avg":{
           "field":"price"
         }
       },
       
     "company":{
       "terms":{
         "field":"make"
          },
        "aggs":{
          "avg_com_price": {
           "avg":{
             "field": "price"
           }
         }
        }
       }
      }
    }
  }
}


GET /cars/transactions/_search
{
  "size":0,
  "aggs":{
    "price":{
      "histogram":{
        "field":"price",
        "interval":20000
      },
      
      "aggs":{
        "revenue":{
          "sum":{
            "field":"price"
          }
        }
      }
    }
  }
}

GET /cars/transactions/_search
{
  "size":0,
  "aggs":{
    "price":{
      "histogram":{
        "field":"price",
        "interval":20000
      },
      
      "aggs":{
        "revenue":{
          "extended_stats":{
            "field":"price"
          }
        }
      }
    }
  }
}

GET cars/transactions/_search
{
  "size":0,
  "aggs": {
    "sales": {
      "date_histogram": {
        "field": "sold",
        "interval": "month",
        "format": "yyyy-MM-dd",
        "min_doc_count" : 0
      }
    }
  }
}


GET cars/transactions/_search
{
  "size":0,
  "aggs": {
    "sales": {
      "date_histogram": {
        "field": "sold",
        "interval": "month",
        "format": "yyyy-MM-dd",
        "min_doc_count" : 0,
        "offset": "1d"
      }
    }
  }
}

GET cars/transactions/_search
{
  "size":0,
  "aggs": {
    "sales": {
      "date_histogram": {
        "field": "sold",
        "interval": "month",
        "format": "yyyy-MM",
        "min_doc_count" : 0
      }
    }
  }
}


GET cars/transactions/_search
{
  "size":0,
  "aggs": {
    "sales": {
      "date_histogram": {
        "field": "sold",
        "interval": "month",
        "format": "yyyy-MM-dd",
        "min_doc_count" : 0,
         "extended_bounds" : {
                "min" : "2014-01-01",
                "max" : "2014-12-31"
         }
      },
      
      "aggs": {
        "per_make_sum": {
          "terms": {
            "field": "make",
            "size": 10
          },
          "aggs": {
            "sum_price": {
              "sum": {
                "field": "price"
              }
            }
          }
        },
       "total_sum": {
         "sum": { 
            "field": "price" 
            } 
         }
      }
    }
  }
}

GET /cars/transactions/_search
{
  "query": {
    "match": {
      "make": "ford"
    }
  },
  "aggs": {
    "colors": {
      "terms": {
        "field": "color",
        "size": 10
      }
    }
  }
}

GET /cars/transactions/_search
{
  "size":0,
  "query": {
    "match": {
      "make": "ford"
    }
  },
  
  "aggs": {
    "recent_sales": {
      "filter": {
        "range":{
          "sold": {
            "from":"now-100M"
          }
        }
      },
    "aggs": {
      "average_price":{
        "avg": {
              "field": "price" 
          }
      }
    }
  }
}
}

　　

-------------- 查询所有数据 -----------
GET _search
{
  "query": {
    "match_all": {}
  }
}


-------------- 查询健康状态 -----------
GET /_cat/health?v


-------------- 查询所有索引 -----------
       GET /_cat/indices?v


-------------- 创建索引 -----------
       PUT /test_index?pretty


-------------- 删除索引 -----------
       DELETE /test_index?pretty



******************************************************* 别名的操作 *******************************************************
-------------- 查看所有索引 -----------
GET /_alias

-------------- 给单个索引增加别名 -----------
      GET /new_index/_alias/new_index_alias
      介绍：为索引new_index定义别名new_index_alias


-------------- 给多个索引增加相同的别名 -----------
POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "new_index", "alias" : "new_index_alias" } },
        { "add" : { "index" : "new_index_2", "alias" : "new_index_alias" } }
    ]
}
或者：
POST /_aliases
{
  "actions": [
    {
      "add": {
        "indices": [ "new_index","new_index_2" ],
        "alias": "new_index_alias"
      }
    }
  ]
}


-------------- 给多个索引增加多个别名 -----------
POST /_aliases
{
    "actions" : [
        { "add":{ "index" : "new_index", "alias" : "new_index_alias" } },
        { "add":{ "index" : "new_index_2", "alias" : "new_index_alias_2" } }
    ]
}


-------------- 根据索引通配符创建别名 -----------
POST /_aliases
{
    	"actions" : [
        	{ "add" : { "index" : "new_index*", "alias" : "new_index_alias" } }
    	]
}


-------------- 索引别名查看 -----------
GET /new_index/_alias/*   
如：查看索引new_index有哪些别名


-------------- 查看多个索引别名查看 -----------
       GET /new_index,new_index_2/_alias/*


-------------- 使用通配符查看多个索引别名查看 -----------
       GET /new_index*/_alias/*


-------------- 确认别名是否存在 -----------
       HEAD /new_index/_alias/new_index_route_alias



-------------- 删除单个索引别名 -----------
       DELETE /new_index/_alias/new_index_alias


-------------- 删除多个索引别名 -----------
       DELETE /new_index,new_index_2/_alias/new_index_alias      #多个索引以英文逗号“,”分隔


-------------- 重命名别名 -----------
POST /_aliases
{
   	 "actions" : [
       	 { "remove" : { "index" : "new_index", "alias" : "new_index_alias" } },
       	 { "add" : { "index" : "new_index_2", "alias" : "new_index_alias" } }
   	 ]
}



   ******************************************************* 数据查询 *******************************************************

   -------------- 查询索引下所有数据 -----------
      GET /2019-06-18_crash_index/crash_info/_search


   -------------- 查询别名下所有数据 -----------
     GET /crash_index/_search




   ******************************************************* metric 查询 *******************************************************






   ******************************************************* 桶查询 *******************************************************
#桶查询，不需要返回具体数据，以filed进行分桶
GET /cars/transactions/_search
{
  "size":0,
  "aggs" : {
  "popular_colors":{
    "terms": {
      "field": "color",
      "size": 10
      }
    }
  }
}