GET /accounts/_search
{
"query": {"match_all": {}}
}
GET /accounts/_search?q=Doe
GET /accounts/_search?q=name:Lily
GET /accounts/_search
{
"query":{
"match":{
"name":"Lily"
}
}
}
GET /accounts/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"name": "Lily"
}
}
],
"should": [
{
"match": {
"lastname": "Doe"
}
}
],
"must_not": [
{
"match": {
"job_desscription": 111
}
}
]
}
}
}
新版语句:
POST /accounts/_doc/1
{
"name":"John",
"lastname":"Doe",
"job_desscription":"Systems administrator and Linux specialit"
}
GET /accounts/_doc/1
POST /accounts/_update/1
{
"doc":{
"name":"Tom"
}
}
DELETE /accounts/_doc/1
head -n 2 /Library/software/nginx/logs/access.log | ./filebeat -e -c nginx.yml
nginx.yml 文件内容
filebeat.prospectors:
- input_type: stdin
output.console:
pretty: true
本地集群搭建
beats output
beats 结构图
提取转化数据,数据处理流。
logstash提取转化数据,数据处理流。
简介,支持哪些网络包
Packetbeat简介,支持哪些包
Packetbeat简介
beats组成,类型
kibana
快速启动集群
方案之logstash
input { beats { port => 5044 }}
filter {
if "search" in [request]{
grok { match => { "request" => ".*\n\{(? <query_ body>.*)"}}grok { match => { "path" => "V(? <index> .*)V. search"}}
if [index] {} else { mutate { add_ field => { "index" => "All"} }}mutate {update => { "query. body" => "{%{query. body}}}}
output {
if "search" in [request]{
elasticsearch{ hosts => "127.0.0.1:8200" }
}}
方案 ◆Production Cluster
◆Elasticsearch http://127.0.0.1:9200
◆Kibana http://127.0.0.1:5601
◆Monitoring Cluster
◆Elasticsearch http://127.0.0.1:8200
◆ bin/elasticsearch -Ecluster.name=sniff search -Ehttp:port=8200 -
Epath.data=sniff
◆Kibana http://127.0.0.1:8601
◆bin/kibana -e http://127.0.0.1:8200 -p 8601
◆Production 与Monitoring不能是一个集群 ,否则会进入抓包死循环
kibana常用功能
query 示例
elastic search query
我是test
本地集群方式
127.0.0.1:8200/_cluster/stats
127.0.0.1:8200/_cat/nodes
bin/elasticsearch -Ehttp.port=8200 -Epath.data=node2
bin/elasticsearch -Ehttp.port=7200 -Epath.data=node2
bin/elasticsearch-cli.bat -Ehttp.port=19200
elasticsearch查询入门
CURD等相关操作
常用术语 - ElasticSearch
常用配置-kibana