Es常用Elasticsearch SQL查询语句

`# 多条件查询
GET /ailpha-saas-hiddendanger*/_search
{ "size":10,
"query": {
"bool": {
"must": [
{
"term": {
"dataFrom": "knownsec"
}
}
],
"must_not": [
{
"term": {
"eventFrom": "WebSOC"
}
},
{
"term": {
"eventFrom": "otherDiscover"
}
}
]
}
}
}

多条件查询

GET /ailpha-saas-hiddendanger*/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"dataFrom": "knownsec"
}
},
{
"term": {
"eventFrom": "otherDiscover"
}
}
]
}
}
}

条件删除

GET /ailpha-saas-hiddendanger*/_doc/_delete_by_query
{
"query": {
"bool": {
"must": [
{
"term": {
"dataFrom": "knownsec"
}
},
{
"term": {
"eventFrom": "otherDiscover"
}
}
]
}
}
}

多条件时间范围查询

GET /ailpha-saas-hiddendanger*/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"dataFrom": "knownsec"
}
},
{
"range": {
"endTime": {
"gte": "2021-9-01 00:00:00",
"lte": "2021-10-01 00:00:00"
}
}
}
]
}
}
}`