elk kibana 日志搜索使用

kibana 測試版本:5.5

官網日志:https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-filter-context.html

query DSL:

增加了多條后

bool 后一級有 "must" "must_not" "filter"

{
  "query": {
    "bool": {
      "must_not": [
        {
          "match": {
            "class": "example01"
          }
        },
        {
          "match": {
            "class": "example02"
          }
        },
        {
          "match": {
            "class": "example03"
          }
        },
        {
          "match": {
            "class": "example04"
          }
        }
      ]
    }
  }
}

3.直接在輸入欄里輸入:
NOT class:(example01 example02 example03 example04)
參考地址:https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-query-string-query.html#query-string-syntax