如果看完前面DSL介紹還是覺得DSL很難的話,可以試試SQL
在7.X版之後內建就支援SQL
SQL | Elasticsearch |
---|---|
column | filed |
row | document |
table | index |
POST /_sql?format=txt
{
"query": "SELECT * FROM \"30day-*\""
}
回傳結果
@timestamp | level | message | staus |
---|---|---|---|
2020-09-28T03:51:02.000Z | DEBUG | 30day very good | null |
2020-09-28T03:51:03.000Z | INFO | 30day very good | null |
2020-09-28T03:51:03.000Z | INFO | 30day very good | 200 |
POST /_sql?format=txt
{
"query": "SELECT * FROM \"30day-*\" WHERE \"staus\" = 200"
}
POST /_sql?format=txt
{
"query": "SELECT * FROM \"30day-*\" WHERE MATCH('level', 'INFO')"
}
POST /_sql/translate
{
"query": "SELECT * FROM \"30day-*\" WHERE \"staus\" = 200"
}
轉出後的DSL
{
"size" : 1000,
"query" : {
"term" : {
"staus" : {
"value" : 200,
"boost" : 1.0
}
}
},
"_source" : {
"includes" : [
"level",
"message",
"staus"
],
"excludes" : [ ]
},
"docvalue_fields" : [
{
"field" : "@timestamp",
"format" : "epoch_millis"
}
],
"sort" : [
{
"_doc" : {
"order" : "asc"
}
}
]
}