// 查询列表数据
func QueryOperateList(ctx context.Context, esClient *elastic.Client, index string, pageNum, pageSize int, start, end int64, execSql string, list []interface{}, operateAccount string, operateAddr string, maxRows, minRows int, dbAddr, namespace string, execResult string) (*message.OperateLogListResp, error) {boolQuery := elastic.NewBoolQuery().Must()if start > 0 && end > 0 && end > start {rangeQuery := elastic.NewRangeQuery("timestamp").Gt(start).Lt(end)boolQuery.Must(rangeQuery)}if len(execSql) > 0 {//execSqlMatchQuery := elastic.NewWildcardQuery("executeStatement", "*"+execSql+"*")//execSqlMatchQuery := elastic.NewFuzzyQuery("executeStatement", execSql).Fuzziness(2)execSqlMatchQuery := elastic.NewMatchQuery("executeStatement", execSql)fmt.Println(execSql)boolQuery.Must(execSqlMatchQuery)}if len(operateAddr) > 0 {operateAddrMatchQuery := elastic.NewMatchQuery("operateOriginAddr", operateAddr)boolQuery.Must(operateAddrMatchQuery)}if len(dbAddr) > 0 {dbAddrMatchQuery := elastic.NewMatchQuery("databaseAddr", dbAddr)boolQuery.Must(dbAddrMatchQuery)}if len(namespace) > 0 {//nameSpaceMatchQuery := elastic.NewMatchQuery("nameSpace", namespace)// 构建 wildcard 查询nameSpaceMatchQuery := elastic.NewWildcardQuery("nameSpace", "*"+namespace+"*")boolQuery.Must(nameSpaceMatchQuery)}if len(execResult) > 0 {execResultMatchQuery := elastic.NewMatchQuery("executeResult", execResult)boolQuery.Must(execResultMatchQuery)}if len(operateAccount) > 0 {operateAccountMatchQuery := elastic.NewWildcardQuery("operateAccount", "*"+operateAccount+"*")//operateAccountMatchQuery := elastic.NewFuzzyQuery("operateAccount", operateAccount)boolQuery.Must(operateAccountMatchQuery)}fmt.Println("max-min:", maxRows, minRows)//0->100:小于100  ；10->0:10到无穷大 0->0 忽略这个条件，max=0 代表无穷大if maxRows == 0 { // 情况1:min有值，max=0,最小值到无穷大    情况2：默认都不填min=0,max=0,0到无穷大；rowsQuery := elastic.NewRangeQuery("affectedRow").Gte(minRows)boolQuery.Must(rowsQuery)} else {rowsQuery := elastic.NewRangeQuery("affectedRow").Gte(minRows).Lte(maxRows)boolQuery.Must(rowsQuery)}fmt.Println("QueryOperateList list：", list)if len(list) > 0 {var newList []interface{}for _, v := range list {newList = append(newList, v)newList = append(newList, strings.ToUpper(v.(string)))}operateTypeMatchQuery := elastic.NewTermsQuery("operateType", newList...)boolQuery.Must(operateTypeMatchQuery)fmt.Println("QueryOperateList newList条件：", newList)}//================ 打印查询条件的 JSON 表示==========//queryJSON, err := boolQuery.Source()if err != nil {log.Fatalf("Error encoding query to JSON: %s", err)}formattedQuery, err := json.MarshalIndent(queryJSON, "", "  ")if err != nil {log.Fatalf("Error formatting JSON: %s", err)}fmt.Println("Elasticsearch Query:")fmt.Println(string(formattedQuery))//===============================================//// 执行ES请求需要提供一个上下文对象ctx2 := context.Background()// 创建Terms桶聚合//aggs := elastic.NewTermsAggregation().Field("operateTime").Size(1000) // 根据shop_id字段值，对数据进行分组searchResult, err := esClient.Search().Index(index).     // 设置索引名Query(boolQuery). // 设置查询条件//Aggregation("count", aggs). // 设置聚合条件，并为聚合条件设置一个名字From((pageNum-1)*pageSize).Size(pageSize).             // 设置分页参数 - 每页大小,设置为0代表不返回搜索结果，仅返回聚合分析结果Sort("operateTime", false). //设置排序字段，根据Created字段升序排序，第二个参数false表示逆序Pretty(true).               // 查询结果返回可读性较好的JSON格式Do(ctx2)                    // 执行请求if err != nil {return nil, err}//fmt.Println("分页：", (pageNum-1)*pageSize, pageSize)OperateListData := message.OperateLogListResp{Total: int(searchResult.TotalHits()),}OperateLogList := []*message.OperateLogInfo{}if searchResult.TotalHits() > 0 {for _, hit := range searchResult.Hits.Hits {var t OperateLogerr := json.Unmarshal(hit.Source, &t)if err != nil {fmt.Print(" 解析日志列表json数据失败\n", err.Error())}info := &message.OperateLogInfo{}info.ExecSql = t.ExecSqlinfo.OperateType = t.OperateTypeinfo.OperateAccount = t.OperateAccountinfo.OperateAddr = t.OperateAddrinfo.DbAddr = t.DbAddrinfo.Namespace = t.Namespaceinfo.Rows = t.Rows//info.Rows, _ = strconv.Atoi(t.Rows)info.ExecResult = t.ExecResultinfo.ExecTime = t.ExecTimeinfo.ResponseTime = t.ResponseTimeOperateLogList = append(OperateLogList, info)//打印每行数据//fmt.Printf("操作类型1： %s， 操作地址: %s ,数据库地址：%s,执行时间：%d\n", t.OperateType, t.OperateAddr, t.DbAddr, t.ExecTime)}} else {fmt.Print(" 没有数据 \n")}OperateListData.List = OperateLogListreturn &OperateListData, nil
}

打印出请求query:

GET infosec***t_new*/_search
{"query": {"bool": {"must": [{"range": {"timestamp": {"from": 1700964412000,"include_lower": false,"include_upper": false,"to": 1701223612000}}},{"match": {"executeStatement": {"query": "update ****-nk6x4'"}}},{"range": {"affectedRow": {"from": 0,"include_lower": true,"include_upper": true,"to": null}}}]}
}}