查询最近一小时内data.@level字段为Error的日志并按date倒序排列，输出最近10条,只输出[date,message]两个字段
GET events*/_search{ "query": {
"bool": {
"must": [
{
"query_string": {
"fields": ["data.@level"],
"query": "Error"
}
}
],
"filter": {
"range": {
"date": {
"gte": "now-1h",
"lte": "now"
}
}
}
}
},
"sort": [
{
"date": {
"order": "desc",
"missing": "_last"
}
}],
"_source": ["date","message"],
"size": 10
}
|