elasticsearch使用笔记

查询

POST/GET  http://192.168.0.1:9200/waf-20*/_search
{"query": {
    "bool":{
       "must": [
          {"match":{"src_ip":"192.168.128.190"} },
          {"range": {
              "@timestamp": {
                 "gte": "2024-01-09 14:00:00",    // "now-1d",
                 "format": "yyyy-MM-dd HH:mm:ss"
              }
           }}// range ]
     } //bool
    } //query
}

删除

DELETE http://192.168.0.1:9200/waf-20*