实现一种像google搜索一样方便的es查询api.PPTVIP

实现一种像google搜索一样方便的es查询api 黄琛(C.Wong) /huangchen007/elasticsearch-rest-command elasticsearch的官方query dsl { match : { message : { query : this is a test, operator : and } } } elasticsearch的官方api特点 优点： 直观，可读性强 机器解析速度也快 扩展性好 缺点： 编写复杂，标点符号多 学习成本稍高 目前更加流行的人机交互接口 SQL系列 grep/awk google搜索/高级搜索 这样的接口 search src=10.9.165.* OR dst= search src=10.9.165.* OR dst= | sort dst search src=10.9.165.* OR dst= | sort dst | stats sum(bytes) as ASumOfBytes by clientip UI（演示） SOURCETYPE=cdr234 APN=CMNET SOURCETYPE=cdr234 APN=CMNET AND CID =41553 SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | TABLE upFlow SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | TABLE upFlow | SORT upFlow SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | TABLE upFlow | STATS SUM(upFlow) SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | TABLE upFlow | STATS SUM(upFlow) BY L4Protocol SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | STATS TIMESPAN=1s SUM(upFlow) BY endTime SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | STATS SPAN=10 SUM(upFlow) BY upFlow SOURCETYPE=cdr234 | STATS DC(MSISDN) SOURCETYPE=cdr234 APN=CMNET AND CID =41553 | JOIN MSISDN (SEARCH SOURCETYPE=userinfo) 支持的命令 search(2014-4-1) search searchoptions BooleanExpression logical expression:and/or/not/嵌套/default=and operator:[!]=/[=]/[=]/ searchoptions: sourcetype/index/hasparent/haschild sort (2014-4-21) ...| sort field [DESC/ASC] stats（2014-4-10） ... | stats [statsoptions] StatsFunction [ByClause] StatsFunction:count(..),sum(..),avg(..),max(..),min(..),dc(...) parameter:fieldname/eval(script) ByClause: By parameterlist statsoptions:minicount,limit,span,timespan join (2014-06-13) ... | join fieldlist ( subsearch ) eg:index=comment | join userid (search index=user) table(2014-06-16) ... | table filedlist filedlist支持通配符 实现/设计 es插件实现vs直接修改代码 javacc vs antlr 程序包 mand 根据语法解析的结果对es集群进行查询并返回结果 com.everdata.parser 语法解析，转换成query dsl org.elasticsearch.plugin.rest 实现plugin所必要的接口 主要调用流程 class CommandRestHandler extends BaseRestH