数据接口示例

1.数据写入:

zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XPOST http://192.168.32.80:9200/logstash-2015.06.21/testlog -d '{
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"
}'
{"_index":"logstash-2015.06.21","_type":"testlog","_id":"AVbklB1aEY-onx06xxpY","_version":1,"_shards":{"total":2,"successful":2,"failed":0},"created":true}zjtest7-frontend:/usr/local/logstash-

2.3.4/config#

2.获取数据:

zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XGET http://192.168.32.80:9200/logstash-2015.06.21/testlog/AVbklB1aEY-onx06xxpY {"_index":"logstash-2015.06.21","_type":"testlog","_id":"AVbklB1aEY-onx06xxpY","_version":1,"found":true,"_source":{
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"
}}zjtest7-frontend:/usr/local/logstash-2.3.4/config#

_source 里的内容,正是之前写入的数据。

}}zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XGET http://192.168.32.80:9200/logstash-2015.06.21/testlog/AVbklB1aEY-onx06xxpY/_source {
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"

来指明要获取的数据部分。

3.数据删除

删除2天前的数据:
[root@dr-mysql01 sbin]# cat del_index.sh
.~ /.bash_profile
v_date=`date +%Y.%m.%d --date='2 days ago'`;
echo $v_date
curl -XDELETE http://192.168.32.80:9200/logstash-*-$v_date 
9.2 搜索请求:

}}]}}zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XGET http://192.168.32.80:9200/logstash-2015.06.21/testlog/_search?q=first {"took":3,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1,"max_score":0.30685282,"hits":[{"_index":"logstash-2015.06.21","_type":"testlog","_id":"AVbklB1aEY-

onx06xxpY","_score":0.30685282,"_source":{
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"

搜索条件为first

1.querystring 语法:

上例中,?q=后面写的就是querystring 语法,鉴于这部分内容会在Kibana上经常使用,这里详细解析一下语法:

1.全文检索：直接写搜索的单词,如上例中的first

2.单字段的全文搜索:在搜索单词之前加上字段名和冒号,比如,如果知道单词first 肯定出现在mesg字段,可以写作mesg:first

}}]}}zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XGET http://192.168.32.80:9200/logstash-2015.06.21/testlog/_search?q=mesg:first {"took":3,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1,"max_score":0.30685282,"hits":[{"_index":"logstash-2015.06.21","_type":"testlog","_id":"AVbklB1aEY-

onx06xxpY","_score":0.30685282,"_source":{
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"
}}]}}zjtest7-frontend:/usr/local/logstash-2.3.4/config#

3.单字段的精确检索:在搜索单词前后加双引号,比如user:"chenlin7"

zjtest7-frontend:/usr/local/logstash-2.3.4/config# curl -XGET http://192.168.32.80:9200/logstash-2015.06.21/testlog/_search?q=user:"scan188" {"took":2,"timed_out":false,"_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1,"max_score":0.30685282,"hits":[{"_index":"logstash-2015.06.21","_type":"testlog","_id":"AVbklB1aEY-

onx06xxpY","_score":0.30685282,"_source":{
"date" :"19999999999",
"user":"scan188",
"mesg":"first message into Elasticsearch"
}}]}}zjtest7-frontend:/usr/local/logstash-2.3.4/config#