helpful elastic search queries

handy_es_queries

## get all the pageviews on the boundary-vpc host in the last hour, sort by timestamp

curl -X GET "http://elastic-04:9200/logstash-2015.03.31/_search/?pretty" -d'
{
    "query": {
        "filtered": {
            "query": {
                "match": {"host" : "boundary-vpc"}
            },
            "filter": {
                "range": {
                    "@timestamp": {
                        "gt" : "now-1h"
                    }
                }
            }
        }
    },
    "sort" : [
        { "@timestamp" : "desc"}
    ]
}' | python -mjson.tool > latest.txt


## get the count of pageviews for each user

curl -X GET "http://elastic-04:9200/logstash-2015.03.31/_search/" -d'
{
    "size": 0,
    "query": {
        "filtered": {
            "query": {
                "match": {"host" : "boundary-vpc"}
            },
            "filter": {
                "range": {
                    "@timestamp": {
                        "gt" : "now-1h"
                    }
                }
            }
        }
    },
    "aggs" : {
        "userId_count" : { "terms" : { "field" : "query_string.userId" } }
    }
}' | python -mjson.tool > latest.txt


## get the last 5 pageviews for user "query_string.userId" : "7a78240ae2cf0a8f"

curl -X GET "http://elastic-04:9200/logstash-2015.03.31/_search/" -d'
{
    "size" : 5,
    "query": {
        "filtered": {
            "query": {
                "match": {"query_string.userId" : "55715e1f5c69a2a2"}
            }
        }
    },
    "sort" : [
        { "@timestamp" : "desc"}
    ]
}' | python -mjson.tool > latest.txt



## search the post content for an arbitrary phrase, limit to 10 results

curl -X GET "http://elastic-04:9200/content/_search/?size=10&pretty" -d'
{
  "query" : {
    "common": {
      "post_content": {
        "query": "waterfront concert series",
        "cutoff_frequency": 0.001,
        "low_freq_operator" : "and"
      }
    }
  }
}'

curl -X GET "http://elastic-06:9200/pageviews/_search/?size=1000&pretty" -d'
{
    "query": {
        "filtered": {
            "query": {
                "match": {"host" : "boundary-vpc"}
            },
            "filter": {
                "range": {
                    "@timestamp": {
                        "gte" : "2015-04-12T00:00:01",
                        "lt": "2015-04-12T00:01:00"
                    }
                }
            }
        }
    }
}' | python -mjson.tool > test.json