1.term查詢
{ "query": { "term": { "title": "crime" } } }
1.1.指定權重
{ "query": { "term": { "title": { "value":"crime", "boost":10.0 } } } }
1.2.多term查詢查詢tags字段中包含novel或book
{ "query": { "terms": { "tags": ["novel","book"] } } }
2.常用詞查詢
2.1.cutoff_frequency查詢低於這個概率的詞將
{ "query": { "common": { "title":{ "query":"crime and punishment", "cutoff_frequency":0.001 } } } }
2.2.match查詢( 不支持lucene查詢語法，分詞后再查詢 )
查詢title包含crime或and或punishment的文檔
{ "query": { "match": { "title": "crime and punishment" } } }
2.3.operator操作符
要求and或者or匹配文本的分詞
{ "query": { "match": { "title": { "query":"crime and punishment", "operator":"and" } } } }
2.4.短語查詢
{ "query": { "match_phrase": { "title": { "query":"crime punishment", "slop":1 } } } }
2.5.前綴查詢
對查詢關鍵詞的最后一個詞條做前綴匹配
{ "query": { "match_phrase_prefix": { "title": { "query":"crime punish", "slop":1, "max_expansions":20 } } } }
2.6.multi_match( 針對多個字段查詢 )
{ "query": { "multi_match": { "query":"crime heller", "fields":["title","author"] } } }
3.query_string查詢( 支持lucene的查詢語法 )
3.1復合語法查詢
title字段包含crime，且權重為10，也要包含punishment，但是otitle不包含cat，同事author字段包含Fyodor和dostoevsky。
{ "query": { "query_string": { "query":"title:crime^10 +title:punishment -otitle:cat +author:(+Fyodor +dostoevsky)", "default_field":"title" } } }
3.2.針對多字段查詢
use_dis_max使用最大分查詢，max指對於給定的關鍵詞，只有最高分才會包括在最后的文檔的評分中，而不是所有包含該詞條的所有字段分數之和。
{ "query": { "query_string": { "query":"crime heller", "fields":["title","author"], "use_dis_max":true } } }
常見寫法：
{“query”:{“query_string”:{“name:obama”}}}
name字段為obama
{“query”:{“query_string”:{“nam\\*:obama”}}}
存在一個nam開頭的字段，值為obama
{“query”:{“query_string”:{“__missing__:name”}}}
name字段值為null的文檔
{“query”:{“query_string”:{“__exists__:name”}}}
name字段值不為null的文檔
{“query”:{“query_string”:{“name:（obama OR xidada)”}}}
name字段為Obama或者xidada的文檔
3.3.simple_query_string查詢
解析出錯時不拋異常，丟棄查詢無效的部分
{ "query": { "simple_query_string": { "query":"title:crime^10 +title:punishment -otitle:cat +author:(+Fyodor +dostoevsky)", "default_operator":"or" } } }
3.4.標識符查詢
{ "query": { "ids": { "type":"book", "values":["1","2","3"] } } }
3.4.前綴查詢
前綴匹配給定的關鍵詞
{ "query": { "prefix": { "title":"cri" } } }
指定權重
{ "query": { "prefix": { "title":{ "value":"cri", "boost":3.0 } } } }
3.5.fuzzy模糊查詢
使用編輯距離的模糊查詢，計算量較大，但是對用戶拼寫錯的場景比較有用
{ "query": { "fuzzy": { "title":"crme" } } }
指定最小相似度偏差
{ "query": { "fuzzy": { "title":{ "value":"crme", "min_similarity":1 } } } }
3.6.通配符查詢
支持*和?等通配符
{ "query": { "wildcard": { "title": "cr?me" } } }
?：任意字符
*：0個或任意多個字符
性能差，必須掃描整個倒排索引，才ok
3.8.范圍查詢
只能針對單個字段，可以是數值型的，也可以是基於字符串的。
{ "query": { "range": { "year": { "gte" :1890, "lte":1900 } } } }
3.8.正則表達式查詢
查詢性能取決於正則表達式
{ "query": { "regexp": { "title": { "value" :"cr.m[ae]", "boost":10.0 //配置評分乘以10 } } } }
K[A-Z].+
[0-9]：指定范圍內的數字
[a-z]：指定范圍內的字母
.：一個字符
+：前面的正則表達式可以出現一次或多次
wildcard和regexp，與prefix原理一致，都會掃描整個索引，性能很差
4.布爾查詢( 組合查詢 )
{ "query": { "bool": { "must": { "term": { "title": "crime" } }, "should": { "range": { "year": { "from": 1900, "to": 2000 } } }, "must_not": { "term": { "otitle": "nothing" } } } } }
mus:必須包含的條件，must not:不包含 ，should:包含的話會更匹配
搜索多個條件：
GET test*/_search { "size":3, "query": { "bool":{ "must": [ {"match":{"message": "學生"}}, {"match":{"message": "所有"}} ], "should": [ {"match": {"port": "53198"}}, {"match": {"@timestamp":"2018-09-17T17:49:25.991Z"}} ], "must_not": [ {"match": {"port": "64273"}}, {"match": {"port":"1234"}} ] } } }
結果：
{ "took": 25, "timed_out": false, "_shards": { "total": 35, "successful": 35, "skipped": 0, "failed": 0 }, "hits": { "total": 14, "max_score": 17.026089, "hits": [ { "_index": "test-name", "_type": "doc", "_id": "Ff0g6GUBPXqEl7zCsbQb", "_score": 17.026089, "_source": { "@timestamp": "2018-09-17T15:23:06.878Z", "appname": "test-name", "level": "INFO", "port": 55714, "thread_name": "main", "level_value": 20000, "appName": "test-name", "@version": 1, "host": "192.168.1.100", "logger_name": "com.example.service.StudentService", "@metdata": { "ip_address": "192.168.1.100" }, "message": "查詢所有學生，pageNo1,pageSize1" } }, { "_index": "test-name", "_type": "doc", "_id": "WFOm6GUBlATfpgHyvD55", "_score": 16.024178, "_source": { "@timestamp": "2018-09-17T17:49:25.991Z", "appname": "test-name", "level": "INFO", "port": 53198, "thread_name": "main", "level_value": 20000, "appName": "test-name", "@version": 1, "host": "192.168.1.100", "logger_name": "com.example.service.StudentService", "@metdata": { "ip_address": "192.168.1.100" }, "message": "查詢所有學生，pageNo1,pageSize1" } }, { "_index": "test-name", "_type": "doc", "_id": "nAMg42UBRHcv2wBhnFDg", "_score": 14.024178, "_source": { "@timestamp": "2018-09-16T16:04:54.948Z", "appname": "test-name", "level": "INFO", "port": 58709, "thread_name": "main", "level_value": 20000, "appName": "test-name", "@version": 1, "host": "172.20.10.6", "logger_name": "com.example.service.StudentService", "@metdata": { "ip_address": "172.20.10.6" }, "message": "查詢所有學生，pageNo1,pageSize1" } } ] } }
還可以這么實現：
GET test*/_search { "size":3, "query": { "query_string":{"query": "message:學生 +message:所有 -port:55714"} } }