mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-04-18 13:20:16 +00:00
parent
49f365ddfd
commit
04c68ba740
@ -22,8 +22,8 @@ GET /_search
|
|||||||
"from": 5,
|
"from": 5,
|
||||||
"size": 20,
|
"size": 20,
|
||||||
"query": {
|
"query": {
|
||||||
"term": {
|
"match": {
|
||||||
"user.id": "8a4f500d"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -30,32 +30,32 @@ You can use the search API's <<search-api-query-params-q,`q` query string
|
|||||||
parameter>> to run a search in the request's URI. The `q` parameter only accepts
|
parameter>> to run a search in the request's URI. The `q` parameter only accepts
|
||||||
queries written in Lucene's <<query-string-syntax,query string syntax>>.
|
queries written in Lucene's <<query-string-syntax,query string syntax>>.
|
||||||
|
|
||||||
To get started, ingest or add some data to an {es} index.
|
To get started, ingest or add some data to an {es} data stream or index.
|
||||||
|
|
||||||
The following <<docs-bulk,bulk API>> request adds some example user log data to
|
The following <<docs-bulk,bulk API>> request adds some example server access log
|
||||||
the `user_logs_000001` index.
|
data to the `my-index-000001` index.
|
||||||
|
|
||||||
[source,console]
|
[source,console]
|
||||||
----
|
----
|
||||||
PUT /user_logs_000001/_bulk?refresh
|
PUT /my-index-000001/_bulk?refresh
|
||||||
{"index":{"_index" : "user_logs_000001", "_id" : "1"}}
|
{ "index":{ } }
|
||||||
{ "@timestamp": "2020-12-06T11:04:05.000Z", "user": { "id": "vlb44hny" }, "message": "Login attempt failed" }
|
{ "@timestamp": "2099-11-15T14:12:12", "http": { "request": { "method": "get" }, "response": { "bytes": 1070000, "status_code": 200 }, "version": "1.1" }, "message": "GET /search HTTP/1.1 200 1070000", "source": { "ip": "127.0.0.1" }, "user": { "id": "kimchy" } }
|
||||||
{"index":{"_index" : "user_logs_000001", "_id" : "2"}}
|
{ "index":{ } }
|
||||||
{ "@timestamp": "2020-12-07T11:06:07.000Z", "user": { "id": "8a4f500d" }, "message": "Login successful" }
|
{ "@timestamp": "2099-11-15T14:12:12", "http": { "request": { "method": "get" }, "response": { "bytes": 1070000, "status_code": 200 }, "version": "1.1" }, "message": "GET /search HTTP/1.1 200 1070000", "source": { "ip": "10.42.42.42" }, "user": { "id": "elkbee" } }
|
||||||
{"index":{"_index" : "user_logs_000001", "_id" : "3"}}
|
{ "index":{ } }
|
||||||
{ "@timestamp": "2020-12-07T11:07:08.000Z", "user": { "id": "l7gk7f82" }, "message": "Logout successful" }
|
{ "@timestamp": "2099-11-15T14:12:12", "http": { "request": { "method": "get" }, "response": { "bytes": 1070000, "status_code": 200 }, "version": "1.1" }, "message": "GET /search HTTP/1.1 200 1070000", "source": { "ip": "10.42.42.42" }, "user": { "id": "elkbee" } }
|
||||||
----
|
----
|
||||||
|
// TESTSETUP
|
||||||
|
|
||||||
You can now use the search API to run a URI search on this index.
|
You can now use the search API to run a URI search on this index.
|
||||||
|
|
||||||
The following URI search matches documents with a `user.id` value of `l7gk7f82`.
|
The following URI search matches documents with a `user.id` value of `kimchy`.
|
||||||
Note the query is specified using the `q` query string parameter.
|
Note the query is specified using the `q` query string parameter.
|
||||||
|
|
||||||
[source,console]
|
[source,console]
|
||||||
----
|
----
|
||||||
GET /user_logs_000001/_search?q=user.id:8a4f500d
|
GET /my-index-000001/_search?q=user.id:kimchy
|
||||||
----
|
----
|
||||||
// TEST[continued]
|
|
||||||
|
|
||||||
The API returns the following response. Note the `hits.hits` property contains
|
The API returns the following response. Note the `hits.hits` property contains
|
||||||
the document that matched the query.
|
the document that matched the query.
|
||||||
@ -63,7 +63,7 @@ the document that matched the query.
|
|||||||
[source,console-result]
|
[source,console-result]
|
||||||
----
|
----
|
||||||
{
|
{
|
||||||
"took": 2,
|
"took": 5,
|
||||||
"timed_out": false,
|
"timed_out": false,
|
||||||
"_shards": {
|
"_shards": {
|
||||||
"total": 1,
|
"total": 1,
|
||||||
@ -79,23 +79,37 @@ the document that matched the query.
|
|||||||
"max_score": 0.9808291,
|
"max_score": 0.9808291,
|
||||||
"hits": [
|
"hits": [
|
||||||
{
|
{
|
||||||
"_index": "user_logs_000001",
|
"_index": "my-index-000001",
|
||||||
"_type": "_doc",
|
"_type": "_doc",
|
||||||
"_id": "2",
|
"_id": "kxWFcnMByiguvud1Z8vC",
|
||||||
"_score": 0.9808291,
|
"_score": 0.9808291,
|
||||||
"_source": {
|
"_source": {
|
||||||
"@timestamp": "2020-12-07T11:06:07.000Z",
|
"@timestamp": "2099-11-15T14:12:12",
|
||||||
"user": {
|
"http": {
|
||||||
"id": "8a4f500d"
|
"request": {
|
||||||
|
"method": "get"
|
||||||
},
|
},
|
||||||
"message": "Login successful"
|
"response": {
|
||||||
|
"bytes": 1070000,
|
||||||
|
"status_code": 200
|
||||||
|
},
|
||||||
|
"version": "1.1"
|
||||||
|
},
|
||||||
|
"message": "GET /search HTTP/1.1 200 1070000",
|
||||||
|
"source": {
|
||||||
|
"ip": "127.0.0.1"
|
||||||
|
},
|
||||||
|
"user": {
|
||||||
|
"id": "kimchy"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TESTRESPONSE[s/"took": 2/"took": "$body.took"/]
|
// TESTRESPONSE[s/"took": 5/"took": "$body.took"/]
|
||||||
|
// TESTRESPONSE[s/"_id": "kxWFcnMByiguvud1Z8vC"/"_id": "$body.hits.hits.0._id"/]
|
||||||
|
|
||||||
[discrete]
|
[discrete]
|
||||||
[[run-request-body-search]]
|
[[run-request-body-search]]
|
||||||
@ -106,21 +120,20 @@ body parameter>> to provide a query as a JSON object, written in
|
|||||||
<<query-dsl,Query DSL>>.
|
<<query-dsl,Query DSL>>.
|
||||||
|
|
||||||
The following request body search uses the <<query-dsl-match-query,`match`>>
|
The following request body search uses the <<query-dsl-match-query,`match`>>
|
||||||
query to match documents with a `message` value of `login successful`. Note the
|
query to match documents with a `user.id` value of `kimchy`. Note the
|
||||||
`match` query is specified as a JSON object in the `query` parameter.
|
`match` query is specified as a JSON object in the `query` parameter.
|
||||||
|
|
||||||
[source,console]
|
[source,console]
|
||||||
----
|
----
|
||||||
GET /user_logs_000001/_search
|
GET /my-index-000001/_search
|
||||||
{
|
{
|
||||||
"query": {
|
"query": {
|
||||||
"match": {
|
"match": {
|
||||||
"message": "login successful"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TEST[continued]
|
|
||||||
|
|
||||||
The API returns the following response.
|
The API returns the following response.
|
||||||
|
|
||||||
@ -131,7 +144,7 @@ score>> that measures how well each document matches the query.
|
|||||||
[source,console-result]
|
[source,console-result]
|
||||||
----
|
----
|
||||||
{
|
{
|
||||||
"took": 1,
|
"took": 5,
|
||||||
"timed_out": false,
|
"timed_out": false,
|
||||||
"_shards": {
|
"_shards": {
|
||||||
"total": 1,
|
"total": 1,
|
||||||
@ -141,55 +154,43 @@ score>> that measures how well each document matches the query.
|
|||||||
},
|
},
|
||||||
"hits": {
|
"hits": {
|
||||||
"total": {
|
"total": {
|
||||||
"value": 3,
|
"value": 1,
|
||||||
"relation": "eq"
|
"relation": "eq"
|
||||||
},
|
},
|
||||||
"max_score": 0.9983525,
|
"max_score": 0.9808291,
|
||||||
"hits": [
|
"hits": [
|
||||||
{
|
{
|
||||||
"_index": "user_logs_000001",
|
"_index": "my-index-000001",
|
||||||
"_type": "_doc",
|
"_type": "_doc",
|
||||||
"_id": "2",
|
"_id": "kxWFcnMByiguvud1Z8vC",
|
||||||
"_score": 0.9983525,
|
"_score": 0.9808291,
|
||||||
"_source": {
|
"_source": {
|
||||||
"@timestamp": "2020-12-07T11:06:07.000Z",
|
"@timestamp": "2099-11-15T14:12:12",
|
||||||
"user": {
|
"http": {
|
||||||
"id": "8a4f500d"
|
"request": {
|
||||||
|
"method": "get"
|
||||||
},
|
},
|
||||||
"message": "Login successful"
|
"response": {
|
||||||
|
"bytes": 1070000,
|
||||||
|
"status_code": 200
|
||||||
|
},
|
||||||
|
"version": "1.1"
|
||||||
|
},
|
||||||
|
"message": "GET /search HTTP/1.1 200 1070000",
|
||||||
|
"source": {
|
||||||
|
"ip": "127.0.0.1"
|
||||||
|
},
|
||||||
|
"user": {
|
||||||
|
"id": "kimchy"
|
||||||
}
|
}
|
||||||
},
|
|
||||||
{
|
|
||||||
"_index": "user_logs_000001",
|
|
||||||
"_type": "_doc",
|
|
||||||
"_id": "3",
|
|
||||||
"_score": 0.49917626,
|
|
||||||
"_source": {
|
|
||||||
"@timestamp": "2020-12-07T11:07:08.000Z",
|
|
||||||
"user": {
|
|
||||||
"id": "l7gk7f82"
|
|
||||||
},
|
|
||||||
"message": "Logout successful"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"_index": "user_logs_000001",
|
|
||||||
"_type": "_doc",
|
|
||||||
"_id": "1",
|
|
||||||
"_score": 0.42081726,
|
|
||||||
"_source": {
|
|
||||||
"@timestamp": "2020-12-06T11:04:05.000Z",
|
|
||||||
"user": {
|
|
||||||
"id": "vlb44hny"
|
|
||||||
},
|
|
||||||
"message": "Login attempt failed"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TESTRESPONSE[s/"took": 1/"took": "$body.took"/]
|
// TESTRESPONSE[s/"took": 5/"took": "$body.took"/]
|
||||||
|
// TESTRESPONSE[s/"_id": "kxWFcnMByiguvud1Z8vC"/"_id": "$body.hits.hits.0._id"/]
|
||||||
|
|
||||||
[discrete]
|
[discrete]
|
||||||
[[search-multiple-indices]]
|
[[search-multiple-indices]]
|
||||||
@ -198,22 +199,21 @@ score>> that measures how well each document matches the query.
|
|||||||
To search multiple data streams and indices, add them as comma-separated values
|
To search multiple data streams and indices, add them as comma-separated values
|
||||||
in the search API request path.
|
in the search API request path.
|
||||||
|
|
||||||
The following request searches the `user_logs_000001` and `user_logs_000002`
|
The following request searches the `my-index-000001` and `my-index-000002`
|
||||||
indices.
|
indices.
|
||||||
|
|
||||||
[source,console]
|
[source,console]
|
||||||
----
|
----
|
||||||
GET /user_logs_000001,user_logs_000002/_search
|
GET /my-index-000001,my-index-000002/_search
|
||||||
{
|
{
|
||||||
"query": {
|
"query": {
|
||||||
"match": {
|
"match": {
|
||||||
"message": "login successful"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TEST[continued]
|
// TEST[s/^/PUT my-index-000002\n/]
|
||||||
// TEST[s/^/PUT user_logs_000002\n/]
|
|
||||||
|
|
||||||
You can also search multiple data streams and indices using a wildcard (`*`)
|
You can also search multiple data streams and indices using a wildcard (`*`)
|
||||||
pattern.
|
pattern.
|
||||||
@ -227,12 +227,11 @@ GET /user_logs*/_search
|
|||||||
{
|
{
|
||||||
"query": {
|
"query": {
|
||||||
"match": {
|
"match": {
|
||||||
"message": "login successful"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TEST[continued]
|
|
||||||
|
|
||||||
To search all data streams and indices in a cluster, omit the target from the
|
To search all data streams and indices in a cluster, omit the target from the
|
||||||
request path. Alternatively, you can use `_all` or `*`.
|
request path. Alternatively, you can use `_all` or `*`.
|
||||||
@ -245,7 +244,7 @@ GET /_search
|
|||||||
{
|
{
|
||||||
"query": {
|
"query": {
|
||||||
"match": {
|
"match": {
|
||||||
"message": "login successful"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -254,19 +253,20 @@ GET /_all/_search
|
|||||||
{
|
{
|
||||||
"query": {
|
"query": {
|
||||||
"match": {
|
"match": {
|
||||||
"message": "login successful"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
GET /*/_search
|
GET /*/_search
|
||||||
{
|
{
|
||||||
"query" : {
|
"query": {
|
||||||
"match" : { "message" : "login" }
|
"match": {
|
||||||
|
"user.id": "kimchy"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
----
|
----
|
||||||
// TEST[continued]
|
|
||||||
|
|
||||||
include::request/from-size.asciidoc[]
|
include::request/from-size.asciidoc[]
|
||||||
|
|
||||||
|
@ -48,8 +48,8 @@ GET /_search
|
|||||||
{
|
{
|
||||||
"_source": false,
|
"_source": false,
|
||||||
"query": {
|
"query": {
|
||||||
"term": {
|
"match": {
|
||||||
"user.id": "8a4f500d"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -65,8 +65,8 @@ GET /_search
|
|||||||
{
|
{
|
||||||
"_source": "obj.*",
|
"_source": "obj.*",
|
||||||
"query": {
|
"query": {
|
||||||
"term": {
|
"match": {
|
||||||
"user.id": "8a4f500d"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -82,8 +82,8 @@ GET /_search
|
|||||||
{
|
{
|
||||||
"_source": [ "obj1.*", "obj2.*" ],
|
"_source": [ "obj1.*", "obj2.*" ],
|
||||||
"query": {
|
"query": {
|
||||||
"term": {
|
"match": {
|
||||||
"user.id": "8a4f500d"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -112,7 +112,7 @@ GET /_search
|
|||||||
},
|
},
|
||||||
"query": {
|
"query": {
|
||||||
"term": {
|
"term": {
|
||||||
"user.id": "8a4f500d"
|
"user.id": "kimchy"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user