1.查询字段create_time存在并且字段project为logging的记录

GET /index_name/_search
{
		"query": {
			"bool": {
				"must": [
				  {
						"term": {
							"project": "logging"
						}
				  },
				  {
						"exists": {
							"field": "create_time"
						}
					}]
			}
		}
}

2.查询字段uuid为*的个数

GET /index_name/_search
{
		"query": {
			"bool": {
				"must": {
						"term": {
							"uuid": "**"
						}
					}
			}
		},
		"aggs": {
			"res": {
				"value_count": {
					"field": "uuid"
				}
			}
		},
		"size": 0
}

3.查询复杂条件下字段count的最大值

GET /df_test_metering/_search
	{
		"query": {
			"bool": {
				"must": [{
						"term": {
							"project": "log"
						}
					},
					{
						"term": {
							"uuid": "**"
						}
					}
				],
				"filter": {
					"range": {
						"time": {
							"gt": 1648742400,
							"lte": 1648828800
						}
					}
				}
			}
		},
		"aggs": {
			"res": {
				"max": {
					"field": "count"
				}
			}
		},
		"size": 0
 }

4.group by指定size,查看各个workspaceUUID的记录数

{
  "aggs": {
    "workspaceUUID": {
      "terms": {
        "field": "workspaceUUID",
        "size":20
      }
          
    }
  },
"size":0
}

5.workspaceUUID的去重个数

{
  "aggs": {
    "count": {
      "cardinality": {
        "field": "workspaceUUID"
      }
    }
  },
	"size":0
}