1.通過kibana查看elasticsearch版本信息
a.左上角三道橫->Management->Dev Tools
b.GET / 執行
c.執行結果
{
“name” : “xxxx”,
“cluster_name” : “xxxxxxx”,
“cluster_uuid” : “vl1UudAoQp-aHWAzyPoMyw”,
“version” : {
“number” : “7.15.1”,
“build_flavor” : “default”,
“build_type” : “docker”,
“build_hash” : “83c34f456ae29d60e94d886e455e6a3409bba9ed”,
“build_date” : “2021-10-07T21:56:19.031608185Z”,
“build_snapshot” : false,
“lucene_version” : “8.9.0”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}

2.精確排除字符串查詢

context:“xx” AND NOT location:“xxx” AND NOT location:“xxx” AND NOT location:“xxx”

3.elasticsearch分桶統計key為traceId的value相同個數大于1的所有key和count
GET /bff-prod*/_search
{
“size”: 0, // 不返回原始文檔
“aggs”: {
“duplicate_traceids”: {
“terms”: {
“field”: “ext.traceId.keyword”, // 確保使用keyword類型字段
“min_doc_count”: 2, // 只返回出現2次以上的結果
“size”: 1000 // 覆蓋所有重復項（按需調整）
}
}
}
}

4.按關鍵字統計個數
GET /bff-prod*/_search
{
“size”: 0,
“aggs”: {
“duplicate_traceids”: {
“terms”: {
“field”: “ext.traceId.keyword”,
“min_doc_count”: 2,
“size”: 1000
}
}
}
}

# 5.帶認證的連接
es = Elasticsearch(
[‘https://10.126.141.98:9200’],
basic_auth=(“elastic”, “z7aJPPruXz9tk26r”),
verify_certs=False # 自簽名證書需關閉驗證:ml-citation{ref=“4” data=“citationList”}
)

5.elasticsearch查詢昨天的數據，分桶統計traceId字段的值重復個數大于1的key和doc_count；
GET /bff-prod*/_search
{
“query”: {
“range”: {
“@timestamp”: {
“gte”: “now-1d/d”,
“lt”: “now/d”,
“time_zone”: “+08:00”
}
}
},
“aggs”: {
“duplicate_traces”: {
“terms”: {
“field”: “ext.traceId.keyword”,
“min_doc_count”: 2,
“size”: 10000
},
“aggs”: {
“bucket_filter”: {
“bucket_selector”: {
“buckets_path”: {
“docCount”: “_count”
},
“script”: “params.docCount > 1”
}
}
}
}
},
“size”: 0
}