中間插播一下Search API使用方式

簡單查詢

GET /30day-000001/_search
{
  "query":{
    "match_all": {}
  }
}

回應訊息

{
  "took" : 3, #執行多少毫秒，通過測量在協調節點上收到請求到協調節點準備發送響應之間經過的時間來計算該值。
  "timed_out" : false, #表示本次查詢是否超時，如果超時返回的結果可能是部分或為空
  "_shards" : { #顯示查詢中參與的分片信息，成功多少分片失敗多少分片等
    "total" : 2, #需要查詢的分片總數，包括未分配的分片。
    "successful" : 2, #成功執行請求的分片數
    "skipped" : 0, #由於輕量級檢查幫助意識到該分片上可能沒有文件匹配而跳過請求的分片數
    "failed" : 0 #未能執行請求的分片數。請注意，未分配的分片將不會被視為成功或失敗。有failed+successful低於total因此，一些碎片未被分配的指示。
  },
  "hits" : {
    "total" : { #有關返回的文檔數的數據。
      "value" : 2, #返回的文檔總數
      "relation" : "eq" #文檔數是準確的還是下限的
    },
    "max_score" : 1.0, #為文檔中所有_score的最大值
    "hits" : [
      {
        "_index" : "30day-000001",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-09-28T03:51:02",
          "message" : "30day very good",
          "level" : "DEBUG"
        }
      },
      {
        "_index" : "30day-000001",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-09-28T03:51:03",
          "message" : "30day very good",
          "level" : "INFO"
        }
      }
    ]
  }
}

分頁查詢

GET /30day-000001/_search
{
  "size": 1, #一次取幾筆，預設10筆
  "from": 1, #從第幾比開始，預設0
  "query":{
    "match_all": {}
  }
}

滾動查詢

GET /30day-000001/_search/?scroll=6h #設定滾動查詢範圍6小時，默認情況下，該值不能超過1d，可以使用search.max_keep_alive群集級別設置更改此限制。
{
  "size": 1,
  "query":{
    "match_all": {}
  }
}

滾動查詢的回應訊息

{
  "_scroll_id" : "FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5VGhlbkZldGNoAhRxXzItMkhRQkpBczZURUkxQmt4OAAAAAAAEEpSFjJVVUJROGRsUWs2bWsxUDJvNHlsTmcUbU9lLTJIUUIxQjdPS3hMbUJ2VjgAAAAAAAUCghZnTGxiU3QzM1RqMnAtc1BHU1FCaXVn", #滾動查詢ID
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "30day-000001",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-09-28T03:51:02",
          "message" : "30day very good",
          "level" : "DEBUG"
        }
      }
    ]
  }
}

接著用滾動查詢ID查詢

GET /_search/scroll
{
  "scroll_id" : "FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5VGhlbkZldGNoAhRxXzItMkhRQkpBczZURUkxQmt4OAAAAAAAEEpSFjJVVUJROGRsUWs2bWsxUDJvNHlsTmcUbU9lLTJIUUIxQjdPS3hMbUJ2VjgAAAAAAAUCghZnTGxiU3QzM1RqMnAtc1BHU1FCaXVn"
}

回傳第二筆的資料

{
  "took" : 10,
  "timed_out" : false,
  "terminated_early" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 2,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "30day-000001",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2020-09-28T03:51:03",
          "message" : "30day very good",
          "level" : "INFO"
        }
      }
    ]
  }
}