之前我们讲解了es,kibana的安装,以及在kibana中简单使用命令来操作es, 下面我们来讲解一些es的基本概念
// windows版本的es,版本6.8.2
{
"name": "ADMIN-PC",
"cluster_name": "elasticsearch",
"cluster_uuid": "ZUC3kkRbSleDzUnrGfdLsQ",
"version": {
"number": "6.8.2",
"build_flavor": "unknown",
"build_type": "unknown",
"build_hash": "b506955",
"build_date": "2019-07-24T15:24:41.545295Z",
"build_snapshot": false,
"lucene_version": "7.7.0",
"minimum_wire_compatibility_version": "5.6.0",
"minimum_index_compatibility_version": "5.0.0"
},
"tagline": "You Know, for Search"
}
index,type,document
index
索引, 可以理解成 MySql的database
type
8.0 后被弃用
类型, 可以理解成MySql的table
document
文档, 可以理解成MySql的某行数据
GET /xiaodoubi/user/1
-->
{
// 索引
"_index" : "xiaodoubi",
// 类型
"_type" : "user",
// 文档的id
"_id" : "1",
// 版本号, Elasticsearch通过使用version来保证对文档的变更能以正确的顺序执行，避免乱序造成的数据丢失。
"_version" : 2,
"_seq_no" : 1,
"_primary_term" : 1,
"found" : true,
// 文档的原始数据。
"_source" : {
"name" : "xiaoming",
"age" : 23,
"sex" : 0
}
}
mapping
ES默认是动态创建索引和索引类型的mapping的。有时候自动创建不符合我们的需求, 我们需要自己建立映射关系。
基础文档操作命令
创建索引
- 自动创建索引
// 创建新的索引
put /books/
-->
// 自动构建映射
{
"acknowledged" : true,
"shards_acknowledged" : true,
"index" : "books"
}
// 查询索引(只有基础信息, 没有索引关系)
GET /books/
-->
{
"books" : {
"aliases" : { },
"mappings" : { },
"settings" : {
"index" : {
"creation_date" : "1614578633250",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "PPs8y6WNQNafEhqE-j4MXw",
"version" : {
"created" : "6080299"
},
"provided_name" : "books"
}
}
}
}
// 我们插入一条数据
PUT /books/_doc/1
{
"title":"java开发指南",
"author":"小逗比",
"price":9.9,
"time":"2021-03-01 10:32:19",
"version":1
}
-->
{
"_index" : "books",
"_type" : "_doc",
"_id" : "1",
"_version" : 1,
"result" : "created",
"_shards" : {
"total" : 2,
"successful" : 1,
"failed" : 0
},
"_seq_no" : 0,
"_primary_term" : 1
}
// 再次查询
GET /books/
-->
{
"books" : {
"aliases" : { },
"mappings" : {
"_doc" : {
"properties" : {
"author" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"price" : {
"type" : "float"
},
"time" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"title" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"version" : {
"type" : "long"
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1614578633250",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "PPs8y6WNQNafEhqE-j4MXw",
"version" : {
"created" : "6080299"
},
"provided_name" : "books"
}
}
}
}
- 手动创建索引
// 手动创建索引
// title string类型
// author keyword
// price double类型
// time date类型
// version integer类型
PUT /books
{
"mappings":{
"_doc":{
"properties":{
"title":{
"type":"text",
// 指定使用中文的分词器
"analyzer": "ik_max_word",
"search_analyzer": "ik_smart"
},
"author":{
"type":"keyword"
},
"version":{
"type":"integer"
},
"price":{
"type":"double"
},
"time":{
"type":"date",
"format":"yyyy-MM-dd HH:mm:ss||epoch_millis"
}
}
}
}
}
-->
{
"acknowledged" : true,
"shards_acknowledged" : true,
"index" : "books"
}
GET /books/
-->
{
"books" : {
"aliases" : { },
"mappings" : {
"_doc" : {
"properties" : {
"author" : {
"type" : "keyword"
},
"price" : {
"type" : "double"
},
"time" : {
"type" : "date",
"format" : "yyyy-MM-dd HH:mm:ss||epoch_millis"
},
"title" : {
"type" : "text"
},
"version" : {
"type" : "integer"
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1614580286774",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "P7lFPuxnS0ed9yFZd7e4wA",
"version" : {
"created" : "6080299"
},
"provided_name" : "books"
}
}
}
}
插入文档
PUT /books/_doc/3
{
"title":"java开发指南",
"author":"小逗比",
"price":9.9,
"time":"2021-03-01 10:32:12",
"version":1
}
-->
{
"_index" : "books",
"_type" : "_doc",
"_id" : "3",
"_version" : 1,
"result" : "created",
"_shards" : {
"total" : 2,
"successful" : 1,
"failed" : 0
},
"_seq_no" : 0,
"_primary_term" : 1
}
查询文档
GET /books/_doc/3
-->
{
"_index" : "books",
"_type" : "_doc",
"_id" : "3",
"_version" : 1,
"_seq_no" : 0,
"_primary_term" : 1,
"found" : true,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 9.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
}
更新文档
POST /books/_doc/3/_update
{
"doc":{
"price":10.9
}
}
-->
{
"_index" : "books",
"_type" : "_doc",
"_id" : "3",
"_version" : 2,
"result" : "noop",
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
}
}
删除文档
DELETE /xiaodoubi/user/1
-->
{
"_index" : "xiaodoubi",
"_type" : "user",
"_id" : "1",
"_version" : 5,
"result" : "deleted",
"_shards" : {
"total" : 2,
"successful" : 1,
"failed" : 0
},
"_seq_no" : 4,
"_primary_term" : 1
}
查询索引信息
GET /xiaodoubi/
-->
{
"xiaodoubi" : {
"aliases" : { },
// 映射信息
"mappings" : {
"user" : {
"properties" : {
"age" : {
"type" : "long"
},
"name" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"sex" : {
"type" : "long"
}
}
}
},
"settings" : {
"index" : {
"creation_date" : "1614569766648",
"number_of_shards" : "5",
"number_of_replicas" : "1",
"uuid" : "fSlKPYtkS_u5s8Nq1VPDCQ",
"version" : {
"created" : "6080299"
},
"provided_name" : "xiaodoubi"
}
}
}
}
查看分词效果
POST /books/_analyze
{
"field": "author",
"text": "Java具有简单性、面向对象、分布式、健壮性、安全性、平台独立与可移植性、多线程、动态性等特点。"
}
-->
// 由于author是keyword, 所以不会对author进行分词
{
"tokens" : [
{
"token" : "Java具有简单性、面向对象、分布式、健壮性、安全性、平台独立与可移植性、多线程、动态性等特点。",
"start_offset" : 0,
"end_offset" : 48,
"type" : "word",
"position" : 0
}
]
}
POST /books/_analyze
{
"field": "title",
"text": "Java具有简单性、面向对象、分布式、健壮性、安全性、平台独立与可移植性、多线程、动态性等特点。"
}
-->
{
"tokens" : [
{
"token" : "java",
"start_offset" : 0,
"end_offset" : 4,
"type" : "ENGLISH",
"position" : 0
},
{
"token" : "具有",
"start_offset" : 4,
"end_offset" : 6,
"type" : "CN_WORD",
"position" : 1
},
{
"token" : "简单",
"start_offset" : 6,
"end_offset" : 8,
"type" : "CN_WORD",
"position" : 2
},
{
"token" : "简",
"start_offset" : 6,
"end_offset" : 7,
"type" : "CN_CHAR",
"position" : 3
},
{
"token" : "单性",
"start_offset" : 7,
"end_offset" : 9,
"type" : "CN_WORD",
"position" : 4
...
}
条件查询
条件查询太多东西, 单独分开写
- text查询
GET /books/_search
{
"query": {
"match": {
"title":"java"
}
}
}
-->
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 0.2876821,
"hits" : [
{
"_index" : "books",
"_type" : "_doc",
"_id" : "2",
"_score" : 0.2876821,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 9.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
},
{
"_index" : "books",
"_type" : "_doc",
"_id" : "3",
"_score" : 0.2876821,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 10.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
}
]
}
}
- keyword查询
不会拆分keyword字段, 所以keyword为精准查询
GET /books/_search
{
"query": {
"match": {
"author":"小"
}
}
}
-->
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}
GET /books/_search
{
"query": {
"match": {
"author":"小逗比"
}
}
}
-->
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 0.2876821,
"hits" : [
{
"_index" : "books",
"_type" : "_doc",
"_id" : "2",
"_score" : 0.2876821,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 9.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
},
{
"_index" : "books",
"_type" : "_doc",
"_id" : "3",
"_score" : 0.2876821,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 10.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
}
]
}
}
条件查询
准备数据
POST /books/_doc/
{
"title":"java开发指南",
"author":"小逗比",
"price":9.9,
"time":"2021-03-01 10:32:12",
"version":1
}
POST /books/_doc/
{
"title":"pyhton开发指南",
"author":"小憨批",
"price":19.9,
"time":"2020-03-01 10:32:12",
"version":1
}
POST /books/_doc/
{
"title":"php开发指南",
"author":"小赤佬",
"price":39.9,
"time":"2020-06-01 10:32:12",
"version":1
}
POST /books/_doc/
{
"title":"老吾老以及人之老, 幼吾幼以及人之幼",
"author":"老",
"price":39.9,
"time":"2020-06-01 10:32:12",
"version":1
}
match查询
- match: 查询
- match_all: 查询所有
- multi_match: 多条件查询
- match_phrase: 包含整个词, 而不是模糊查询
// match
GET /books/_search
{
"query": {
"match": {
"author": "小赤佬"
}
}
}
// match_all
GET /books/_search
{
"query": {
"match_all": {}
}
}
// multi_match
GET /books/_search
{
"query": {
"multi_match": {
"query": "老",
"fields": ["title", "author"]
}
}
}
// match_phrase
GET /books/_search
{
"query": {
"match_phrase": {
"title": "老老"
}
}
}
GET /books/_search
{
"query": {
"match_phrase": {
"title": "以及"
}
}
}
GET /books/_search
{
"query": {
"match_phrase": {
"title": "以及幼"
}
}
}
GET /books/_search
{
"query": {
"match": {
"title": "以及幼"
}
}
}
match_phrase的示例以及和mathc的比较, 我们知道,match_phrase必须是连词, 连在一起的, match可以不需要连在一起
term和terms查询
term查询不知道分词器的存在, 直接根据关键字去查询, 所以term适合keyword查询
- term
// 可以查询的到, 因为`老吾老`在分词后的关键词中
GET /books/_search
{
"query": {
"term": {
"title": {
"value": "老吾老"
}
}
}
}
// 查询不到, `老吾`不在分词后的关键词中
GET /books/_search
{
"query": {
"term": {
"title": {
"value": "老吾"
}
}
}
}
- terms
GET /books/_search
{
"query": {
"terms": {
"title": [
"老吾老",
"php"
]
}
}
}
分页查询
GET /books/_search
{
"from": 0,
"size": 2,
"query": {
"terms": {
"title": [
"老吾老",
"开发"
]
}
}
}
指定返回的字段
// 直接指定
GET /books/_search
{
"query": {
"match": {
"title": "开发"
}
},
"_source": ["title", "author"]
}
// 通配符
GET /books/_search
{
"query": {
"match": {
"title": "开发"
}
},
"_source": {
"includes": ["price","t*"],
"excludes": "tim*"
}
}
排序
// 直接指定
GET /books/_search
{
"query": {
"match": {
"title": "开发"
}
},
"sort": [
{
"price": {
"order": "desc"
}
}
]
}
范围查询
GET /books/_search
{
"query": {"range": {
"price": {
"gte": 10,
"lte": 20
}
}}
}
wildcard
允许使用通配符* 和 ?来进行查询
* 代表0个或多个字符
? 代表任意一个字符
GET /books/_search
{
"query": {
"wildcard": {
"author": {
"value": "小*"
}
}
}
}
GET /books/_search
{
"query": {
"wildcard": {
"author": {
"value": "小逗?"
}
}
}
}
fuzzy模糊查询
// phthon拼错了, 但是可以查询到python的数据
GET /books/_search
{
"query": {
"fuzzy": {
"title": {
"value": "phthon"
}
}
}
}
Filter查询
GET /books/_search
{
"post_filter": {
"term": {
"title": "老吾老"
}
}
}
GET /books/_search
{
"post_filter": {
"terms": {
"title": ["老吾老", "php"]
}
}
}
多条件查询
must： 必须匹配。贡献算分
must_not：过滤子句，必须不能匹配，但不贡献算分
should： 选择性匹配，至少满足一条。贡献算分
filter： 过滤子句，必须匹配，但不贡献算分
GET /books/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"title": "开发"
}
},
{
"range": {
"price": {
"gte": 10,
"lte": 20
}
}
}
]
}
}
}
聚合查询
聚合是指可以对数据进行统计分析, es的聚合有4类: Metric(指标）、Bucketing(桶）、Matrix(矩阵）、Pipeline(管道）
Metric(指标): 指标分析类型，如计算最大值、最小值、平均值等等 （对桶内的文档进行聚合分析的操作）
Bucket(桶): 分桶类型，类似SQL中的GROUP BY语法 （满足特定条件的文档的集合）
Pipeline(管道): 管道分析类型，基于上一级的聚合分析结果进行在分析
Matrix(矩阵): 矩阵分析类型（聚合是一种面向数值型的聚合，用于计算一组文档字段中的统计信息）
Metric
Metric聚合分析根据输出的结果个数分为单值分析和多值分析两类：
#1、单值分析，只输出一个分析结果
min,max,avg,sum,cardinality
#2、多值分析，输出多个分析结果
stats,extended_stats,percentile,percentile_rank,top hits
最大值
GET /books/_search
{
"aggs": {
"max_price": {
"max": {
"field": "price"
}
}
}
}
最小值
GET /books/_search
{
"aggs": {
"min_price": {
"min": {
"field": "price"
}
}
}
}
平均值
GET /books/_search
{
"aggs": {
"avg_price": {
"avg": {
"field": "price"
}
}
}
}
求和
GET /books/_search
{
"aggs": {
"sum_price": {
"sum": {
"field": "price"
}
}
}
}
唯一值
// 总共有多少个作者
GET /books/_search
{
"aggs": {
"author_num": {
"cardinality": {
"field": "author"
}
}
}
}
// 不同价格的数量
GET /books/_search
{
"aggs": {
"price_count": {
"cardinality": {
"field": "price"
}
}
}
}
status
把各种指标都显示出来了
GET /books/_search
{
"aggs": {
"status_price": {
"stats": {
"field": "price"
}
}
}
}
-->
// 结果有省略
...
"aggregations" : {
"status_price" : {
"count" : 4,
"min" : 9.9,
"max" : 39.9,
"avg" : 27.4,
"sum" : 109.6
}
}
...
extended_stats
GET /books/_search
{
"aggs": {
"extended_status_price": {
"extended_stats": {
"field": "price"
}
}
}
}
-->
{
...
"aggregations" : {
"status_price" : {
"count" : 4,
"min" : 9.9,
"max" : 39.9,
"avg" : 27.4,
"sum" : 109.6,
"sum_of_squares" : 3678.04,
"variance" : 168.7500000000001,
"std_deviation" : 12.990381056766584,
"std_deviation_bounds" : {
"upper" : 53.380762113533166,
"lower" : 1.4192378864668314
}
}
}
}
percentile 求百分比
对指定字段的值按从小到大累计每个值对应的文档数的占比，返回指定占比比例对应的值。
GET /books/_search
{
"aggs": {
"percent_price": {
"percentiles": {
"field": "price",
"percents": [
1,
5,
25,
50,
75,
95,
99
]
}
}
}
}
// 返回hash
GET /books/_search
{
"size": 0,
"aggs": {
"percent_price": {
"percentiles": {
"field": "price",
"keyed":false,
"percents": [
1,
5,
25,
50,
75,
95,
99
]
}
}
}
}
percentile_rank
上面是指定了比值计算该比值对应的值, 这边是通过值, 求对应值的百分比
GET /books/_search
{
"size": 0,
"aggs": {
"price_rank": {
"percentile_ranks": {
"field": "price",
"values": [
29.9,
49.9
]
}
}
}
}
-->
// 我们一共4条数据, 其价格分别为 9.9,19.9,39.9,39.9, 因此价格小于29.9有2条, 占比50%, 价格小于49.9的4条, 占比100%
{
...
"aggregations" : {
"price_rank" : {
"values" : {
"29.9" : 50.0,
"49.9" : 100.0
}
}
}
}
- 出现问题
下面的比值没有看懂为啥是33.33...???
GET /books/_search
{
"size": 0,
"aggs": {
"price_rank": {
"percentile_ranks": {
"field": "price",
"values": [
19.9,
49.9
]
}
}
}
}
-->
{
...
"aggregations" : {
"price_rank" : {
"values" : {
"19.9" : 33.33333333333333,
"49.9" : 100.0
}
}
}
}
top_hits
返回分桶后的前几条
GET /books/_search
{
"size": 0,
"aggs": {
// 按价格分桶
"top_price": {
"terms": {
"field": "price",
"size": 10
},
// 返回每个价格的第一条
"aggs": {
"top_version_hits": {
"top_hits": {
"size": 1
}
}
}
}
}
}
-->
{
"took" : 10,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 4,
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"top_price" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : 39.9,
"doc_count" : 2,
"top_version_hits" : {
"hits" : {
"total" : 2,
"max_score" : 1.0,
"hits" : [
{
"_index" : "books",
"_type" : "_doc",
"_id" : "QVUx7XcBNThmh3q1xKMI",
"_score" : 1.0,
"_source" : {
"title" : "php开发指南",
"author" : "小赤佬",
"price" : 39.9,
"time" : "2020-06-01 10:32:12",
"version" : 1
}
}
]
}
}
},
{
"key" : 9.9,
"doc_count" : 1,
"top_version_hits" : {
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [
{
"_index" : "books",
"_type" : "_doc",
"_id" : "P1Ux7XcBNThmh3q1jaOf",
"_score" : 1.0,
"_source" : {
"title" : "java开发指南",
"author" : "小逗比",
"price" : 9.9,
"time" : "2021-03-01 10:32:12",
"version" : 1
}
}
]
}
}
},
{
"key" : 19.9,
"doc_count" : 1,
"top_version_hits" : {
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [
{
"_index" : "books",
"_type" : "_doc",
"_id" : "QFUx7XcBNThmh3q1tqMa",
"_score" : 1.0,
"_source" : {
"title" : "pyhton开发指南",
"author" : "小憨批",
"price" : 19.9,
"time" : "2020-03-01 10:32:12",
"version" : 1
}
}
]
}
}
}
]
}
}
}
bucket
相当于Mysql中的group by, 将相同条件的数据放入到同一个桶中, 一共有：Terms Aggregation 、Filter Aggregation、Histogram Aggregation、Range Aggregation 、Date Aggregation。
Terms Aggregation
根据某个字段来分桶
GET /books/_search
{
"size": 0,
"aggs": {
"top_price": {
"terms": {
"field": "price",
"size": 10
}
}
}
}
-->
{
...
"aggregations" : {
"top_price" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : 39.9,
"doc_count" : 2
},
{
"key" : 9.9,
"doc_count" : 1
},
{
"key" : 19.9,
"doc_count" : 1
}
]
}
}
}
Filter Aggregation
GET /books/_search
{
"size": 0,
"aggs": {
"book": {
// 只获取价格为39.9的文档
"filter": {
"term": {
"price": "39.9"
}
},
"aggs": {
// 求最小的版本号
"min_version": {
"min": {
"field": "version"
}
}
}
}
}
}
Histogram Aggreagtion
上面是按term进行分桶, Histogram是按区间进行分桶
GET /books/_search
{
"aggs": {
"price_histogram": {
"histogram": {
"field": "price",
"interval": 10
}
}
}
}
-->
// 我们一共4条数据, 其价格分别为 9.9,19.9,39.9,39.9, 因此0~10: 有1条, 10~20: 有1条, 20~30: 没有, 30以上: 2条
{
...
"aggregations" : {
"price_histogram" : {
"buckets" : [
{
"key" : 0.0,
"doc_count" : 1
},
{
"key" : 10.0,
"doc_count" : 1
},
{
"key" : 20.0,
"doc_count" : 0
},
{
"key" : 30.0,
"doc_count" : 2
}
]
}
}
}
Range Aggregation
根据条件进行分桶
GET /books/_search
{
"size": 0,
"aggs": {
"price_range": {
"range": {
"field": "price",
"ranges": [
{
"to": 10
},
{
"from": 10,
"to": 20
},
{
"from": 20,
"to": 30
},
{
"from": 30
}
]
}
}
}
}
-->
// 这么写和上面的是同一个意思
{
...
"aggregations" : {
"price_range" : {
"buckets" : [
{
"key" : "*-10.0",
"to" : 10.0,
"doc_count" : 1
},
{
"key" : "10.0-20.0",
"from" : 10.0,
"to" : 20.0,
"doc_count" : 1
},
{
"key" : "20.0-30.0",
"from" : 20.0,
"to" : 30.0,
"doc_count" : 0
},
{
"key" : "30.0-*",
"from" : 30.0,
"doc_count" : 2
}
]
}
}
}
Date Aggregation
根据时间来分桶
- date_histogram
GET /books/_search
{
"size": 0,
"aggs": {
"date_range": {
"date_histogram": {
"field": "time",
"interval": "year"
}
}
}
}
-->
{
...
"aggregations" : {
"date_range" : {
"buckets" : [
{
"key_as_string" : "2020-01-01 00:00:00",
"key" : 1577836800000,
"doc_count" : 3
},
{
"key_as_string" : "2021-01-01 00:00:00",
"key" : 1609459200000,
"doc_count" : 1
}
]
}
}
}
- date_range
now/y 当前时间/y, 把时间格式化为当年的第一天 now: 2021-03-02 03:40:13 now/y --> 2021-01-01 00:00:00
now/M 当前时间/M, 把时间格式化为当前月的第一天 now: 2021-03-02 03:40:13 now/M --> 2021-03-01 00:00:00
以此类推:
now/d: now: 2021-03-02 03:40:13 now/M --> 2021-03-02 00:00:00
GET /books/_search
{
"size": 0,
"aggs": {
"date_range": {
"date_range": {
"field": "time",
"ranges": [
{
"from": "now-1M",
"to": "now"
}
]
}
}
}
}
-->
{
...
"aggregations" : {
"date_range" : {
"buckets" : [
{
"key" : "2021-02-02 03:38:06-2021-03-02 03:38:06",
"from" : 1.612237086535E12,
"from_as_string" : "2021-02-02 03:38:06",
"to" : 1.614656286535E12,
"to_as_string" : "2021-03-02 03:38:06",
"doc_count" : 1
}
]
}
}
}
GET /books/_search
{
"size": 0,
"aggs": {
"date_range": {
"date_range": {
"field": "time",
"ranges": [
{
"from": "now/y",
"to": "now"
}
]
}
}
}
}
-->
{
...
"aggregations" : {
"date_range" : {
"buckets" : [
{
"key" : "2021-01-01 00:00:00-2021-03-02 03:38:33",
"from" : 1.6094592E12,
"from_as_string" : "2021-01-01 00:00:00",
"to" : 1.614656313412E12,
"to_as_string" : "2021-03-02 03:38:33",
"doc_count" : 1
}
]
}
}
}
GET /books/_search
{
"size": 0,
"aggs": {
"date_range": {
"date_range": {
"field": "time",
"ranges": [
{
"from": "2020-01-01 00:00:00",
"to":"2023-01-01 00:00:00"
}
]
}
}
}
}