pip install elasticsearch

from elasticsearch import Elasticsearches = Elasticsearch([{'host':'10.10.13.12','port':9200}])

es.search(index='logstash-2015.08.20', q='http_status_code:5* AND server_name:"web1"', from_='124119')

In[52]: es.count(index='logstash-2015.08.21', q='http_status_code:500')Out[52]:{u'_shards':{u'failed':0, u'successful':5, u'total':5}, u'count':17042}

# Initialize the scrollpage = es.search(    index ='yourIndex',    doc_type ='yourType',    scroll ='2m',    search_type ='scan',    size =1000,    body ={    # Your query's body})sid = page['_scroll_id']scroll_size = page['hits']['total']# Start scrollingwhile(scroll_size >0):    

{    "query":{        "filtered":{            "query":{"match":{"http_status_code":500}},            "filter":{"term":{"server_name":"vip03"}}        }    }}

{'facets':    {'stat':        {'terms':            {'field':'http_status_code',              'order':'count',        'size':50}        }    },    'size':0}        

{'facets':    {'cip':        {'terms':            {'fields':['client_ip']}},              'status_facets':{'terms':{'fields':['http_status_code'],              'order':'term',              'size':50}}},        'query':{'query_string':{'query':'*'}},    'size':0}

{'facets':    {'tag':        {'terms':            {'fields':['http_status_code','client_ip'],              'size':10           }        }    },    'query':        {'match_all':{}},    'size':0} 

{  "facets": {    "0": {      "date_histogram": {        "field": "@timestamp",        "interval": "5m"      },      "facet_filter": {        "fquery": {          "query": {            "filtered": {              "query": {                "query_string": {                  "query": "*"                }              },              "filter": {                "bool": {                  "must": [                    {                      "range": {                        "@timestamp": {                          'gt': 'now-1h'                        }                      }                    },                    {                      "exists": {                        "field": "http_status_code.raw"                      }                    },                    # --------------- -------                    # 此處加匹配條件                  ]                }              }            }          }        }      }    }  },  "size": 0}