Kibana 5.x DevTool常用命令
1、match_all 查询
GET _search
{
"query": {
"match_all": {
"boost" : 1.0
}
}
}
2、使用Elasticsearch的时间字段，按照小时进行聚合查询（该为hourOfDay也可以查询dayOfWeek）
其中orderTime为时间字段
POST my_index_name/my_type_name/_search
{
"query" : {
"bool" : {
"must" : [
{
"range" : {
"orderTime" : {
"from" : "2017-10-01T00:00:00.000Z",
"to" : "2017-10-31T23:59:59.999Z",
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
}
],
"disable_coord" : false,
"adjust_pure_negative" : true,
"boost" : 1.0
}
},
"aggs": {
"hour": {
"terms": {
"size": 24,
"script": {
"lang": "painless",
"source": "doc['orderTime'].date.hourOfDay"
},
"order" : { "_term" : "asc" }
}
}
},
"size": 0
}结果如下：
{
"took": 2040,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 13200437,
"max_score": 0,
"hits": []
},
"aggregations": {
"hour": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "0",
"doc_count": 647778
},
{
"key": "1",
"doc_count": 367104
},
{
"key": "10",
"doc_count": 465885
},
{
"key": "11",
"doc_count": 521330
},
{
"key": "12",
"doc_count": 657373
},
{
"key": "13",
"doc_count": 695066
},
{
"key": "14",
"doc_count": 655091
},
{
"key": "15",
"doc_count": 634047
},
{
"key": "16",
"doc_count": 645829
},
{
"key": "17",
"doc_count": 681893
},
{
"key": "18",
"doc_count": 726542
},
{
"key": "19",
"doc_count": 850149
},
{
"key": "2",
"doc_count": 209313
},
{
"key": "20",
"doc_count": 971456
},
{
"key": "21",
"doc_count": 1076897
},
{
"key": "22",
"doc_count": 1073018
},
{
"key": "23",
"doc_count": 907532
},
{
"key": "3",
"doc_count": 132610
},
{
"key": "4",
"doc_count": 84856
},
{
"key": "5",
"doc_count": 86609
},
{
"key": "6",
"doc_count": 148654
},
{
"key": "7",
"doc_count": 243315
},
{
"key": "8",
"doc_count": 323679
},
{
"key": "9",
"doc_count": 394411
}
]
}
}
}
3、查询集群节点是否禁用内存交换（swapping）
GET _nodes?filter_path=**.mlockall结果如下：
{
"nodes": {
"AQCgSBBGQHmHuSGuVRogVA": {
"process": {
"mlockall": true
}
},
"srpVG_BSRYaVYRk1H_RPMw": {
"process": {
"mlockall": true
}
}
}
}
4、查询集群节点的最大文件描述符
GET _nodes/stats/process?filter_path=**.max_file_descriptors结果如下：
{
"nodes": {
"AQCgSBBGQHmHuSGuVRogVA": {
"process": {
"max_file_descriptors": 65536
}
},
"srpVG_BSRYaVYRk1H_RPMw": {
"process": {
"max_file_descriptors": 65536
}
}
}
}
5、打开（默认关闭）动态数字映射
PUT my_index_name
{
"mappings": {
"my_type": {
"numeric_detection": true
}
}
}
6、集群分片情况查询
GET _cat/shards结果大致如下：
geleevr 2 p STARTED 19939152 4.2gb 192.168.10.20 node-1
geleevr 2 r STARTED 19939152 4.2gb 192.168.10.21 node-2
geleevr 1 p STARTED 19943629 4.5gb 192.168.10.20 node-1
geleevr 1 r STARTED 19943628 4.5gb 192.168.10.21 node-2
geleevr 4 p STARTED 19947209 4.4gb 192.168.10.20 node-1
geleevr 4 r STARTED 19947209 4.4gb 192.168.10.21 node-2
geleevr 3 p STARTED 19941227 4.4gb 192.168.10.20 node-1
geleevr 3 r STARTED 19941227 4.4gb 192.168.10.21 node-2
geleevr 0 p STARTED 19929450 4.4gb 192.168.10.20 node-1
geleevr 0 r STARTED 19929450 4.4gb 192.168.10.21 node-2
7、update_by_query操作
修改_id为满足条件的数组（该query查询可以使用其他lucene语法），将type_text字段的值修改为ABCD
GET my_index_name/my_type_name/_update_by_query
{
"query": {
"bool": {
"filter": {
"terms": {
"_id": ["AV-1CviL38rfcwO8CQmT","AV-1CviL38rfcwO8CQl_"]
}
}
}
},
"script": {
"inline":"ctx._source.type_text = 'ABCD'"
}
}