查询最近一小时内data.@level字段为Error的日志并按date倒序排列，输出最近10条,只输出[date,message]两个字段
GET events*/_search{ "query": { "bool": { "must": [ { "query_string": { "fields": ["data.@level"], "query": "Error" } } ], "filter": { "range": { "date": { "gte": "now-1h", "lte": "now" } } } } }, "sort": [ { "date": { "order": "desc", "missing": "_last" } }], "_source": ["date","message"], "size": 10 } |